@burdenoff/microfe-auth 2026.527.1 → 2026.527.3

package/dist/auth/pages/RegisterPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"RegisterPage.js","names":[],"sources":["../../../src/auth/pages/RegisterPage.tsx"],"sourcesContent":["import { useState } from \"react\";\nimport { useNavigate } from \"react-router-dom\";\nimport { useI18n } from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport { validateEmail, validatePassword } from \"../utils\";\nimport { useAuthOperations } from \"../hooks/useAuthOperations\";\nimport { useOAuthOperations } from \"../hooks/useOAuthOperations\";\nimport { AuthLayout } from \"../components/AuthLayout\";\nimport {\n  EmailIcon,\n  LockIcon,\n  UserIcon,\n  EyeIcon,\n  EyeOffIcon,\n  AlertIcon,\n  CheckIcon,\n  XIcon,\n  SpinnerIcon,\n  GoogleIcon,\n  GitHubIcon,\n  MicrosoftIcon,\n} from \"../components/AuthIcons\";\nimport { useAuth } from \"../providers/AuthProvider\";\nimport { CaptchaV2, isCaptchaEnabled } from \"../components/CaptchaV2\";\nimport type { SignUpInput } from \"../types\";\n\n/**\n * Registration page with professional design\n */\nexport function RegisterPage() {\n  const { productName } = useAuth();\n  const navigate = useNavigate();\n  const { t } = useI18n();\n  const tr = (key: string, fallback: string): string => {\n    const translated = t(key);\n    return translated === key ? fallback : translated;\n  };\n  const { signUp, resendVerification, isLoading } = useAuthOperations();\n  const { initiateGoogleOAuth, initiateMicrosoftOAuth, isProviderConfigured } =\n    useOAuthOperations();\n  const [showPassword, setShowPassword] = useState(false);\n  const [formData, setFormData] = useState<SignUpInput>({\n    email: \"\",\n    username: \"\",\n    password: \"\",\n    firstName: \"\",\n    lastName: \"\",\n  });\n  const [validationErrors, setValidationErrors] = useState<string[]>([]);\n  const [signupSuccess, setSignupSuccess] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const [oauthError, setOauthError] = useState<string | null>(null);\n  const [captchaToken, setCaptchaToken] = useState<string | null>(null);\n  const [isResendingVerification, setIsResendingVerification] = useState(false);\n  const [resendError, setResendError] = useState<string | null>(null);\n\n  // Password strength indicators\n  const passwordChecks = (() => {\n    const password = formData.password;\n    return [\n      {\n        label: tr(\"auth.register.pwMin8\", \"At least 12 characters\"),\n        met: password.length >= 12,\n      },\n      {\n        label: tr(\"auth.register.pwUppercase\", \"One uppercase letter\"),\n        met: /[A-Z]/.test(password),\n      },\n      {\n        label: tr(\"auth.register.pwLowercase\", \"One lowercase letter\"),\n        met: /[a-z]/.test(password),\n      },\n      {\n        label: tr(\"auth.register.pwNumber\", \"One number\"),\n        met: /\\d/.test(password),\n      },\n      {\n        label: tr(\"auth.register.pwSpecial\", \"One special character\"),\n        met: /[!@#$%^&*(),.?\":{}|<>]/.test(password),\n      },\n    ];\n  })();\n\n  const passwordStrength = (() => {\n    const metCount = passwordChecks.filter((c) => c.met).length;\n    if (metCount <= 2)\n      return {\n        level: tr(\"auth.register.passwordStrengthWeak\", \"weak\"),\n        color: \"bg-status-error-bg-subtle0\",\n        width: \"w-1/4\",\n      };\n    if (metCount <= 3)\n      return {\n        level: tr(\"auth.register.passwordStrengthFair\", \"fair\"),\n        color: \"bg-status-warning-text\",\n        width: \"w-2/4\",\n      };\n    if (metCount <= 4)\n      return {\n        level: tr(\"auth.register.passwordStrengthGood\", \"good\"),\n        color: \"bg-status-warning-bg-subtle0\",\n        width: \"w-3/4\",\n      };\n    return {\n      level: tr(\"auth.register.passwordStrengthStrong\", \"strong\"),\n      color: \"bg-status-success-text\",\n      width: \"w-full\",\n    };\n  })();\n\n  const handleSubmit = async (e: React.FormEvent) => {\n    e.preventDefault();\n\n    const errors: string[] = [];\n    if (!validateEmail(formData.email)) {\n      errors.push(\n        tr(\"auth.register.invalidEmail\", \"Please enter a valid email address\"),\n      );\n    }\n    if (!formData.username || formData.username.length < 3) {\n      errors.push(\n        tr(\n          \"auth.register.usernameMin3\",\n          \"Username must be at least 3 characters\",\n        ),\n      );\n    }\n    if (!/^[a-zA-Z0-9_-]+$/.test(formData.username)) {\n      errors.push(\n        tr(\n          \"auth.register.usernameChars\",\n          \"Username can only contain letters, numbers, underscores, and hyphens\",\n        ),\n      );\n    }\n    const passwordValidation = validatePassword(formData.password);\n    if (!passwordValidation.valid) {\n      errors.push(...passwordValidation.errors);\n    }\n\n    if (isCaptchaEnabled() && !captchaToken) {\n      errors.push(\n        tr(\n          \"auth.register.completeCaptcha\",\n          \"Please complete the reCAPTCHA verification\",\n        ),\n      );\n    }\n\n    if (errors.length > 0) {\n      setValidationErrors(errors);\n      return;\n    }\n\n    setValidationErrors([]);\n    setError(null);\n    try {\n      await signUp({\n        ...formData,\n        ...(captchaToken ? { recaptchaToken: captchaToken } : {}),\n      });\n      // Sign up successful - check if email verification is required\n      // (Backend returns empty tokens when email verification is needed)\n      setSignupSuccess(true);\n    } catch (err) {\n      const message =\n        err instanceof Error\n          ? err.message\n          : tr(\"auth.register.signUpFailed\", \"Sign up failed\");\n      setError(message);\n      console.error(\"Sign up failed:\", err);\n    }\n  };\n\n  /**\n   * Handle Google OAuth signup\n   */\n  const handleGoogleSignup = () => {\n    setOauthError(null);\n    try {\n      initiateGoogleOAuth();\n    } catch (err) {\n      setOauthError(\n        err instanceof Error\n          ? err.message\n          : tr(\n              \"auth.register.googleSignUpFailed\",\n              \"Failed to initiate Google sign up\",\n            ),\n      );\n    }\n  };\n\n  /**\n   * Handle Microsoft OAuth signup\n   */\n  const handleMicrosoftSignup = () => {\n    setOauthError(null);\n    try {\n      initiateMicrosoftOAuth();\n    } catch (err) {\n      setOauthError(\n        err instanceof Error\n          ? err.message\n          : tr(\n              \"auth.register.microsoftSignUpFailed\",\n              \"Failed to initiate Microsoft sign up\",\n            ),\n      );\n    }\n  };\n\n  // Check if OAuth providers are configured\n  const isGoogleConfigured = isProviderConfigured(\"google\");\n  const isMicrosoftConfigured = isProviderConfigured(\"microsoft\");\n\n  const oauthProviders = [\n    {\n      name: \"Google\",\n      icon: GoogleIcon,\n      onClick: handleGoogleSignup,\n      disabled: !isGoogleConfigured,\n      tooltip: isGoogleConfigured\n        ? undefined\n        : tr(\n            \"auth.register.googleNotConfigured\",\n            \"Google sign up is not configured\",\n          ),\n    },\n    {\n      name: \"GitHub\",\n      icon: GitHubIcon,\n      onClick: () => {},\n      disabled: true,\n      tooltip: tr(\n        \"auth.register.githubNotConfigured\",\n        \"GitHub sign up is not configured\",\n      ),\n    },\n    {\n      name: \"Microsoft\",\n      icon: MicrosoftIcon,\n      onClick: handleMicrosoftSignup,\n      disabled: !isMicrosoftConfigured,\n      tooltip: isMicrosoftConfigured\n        ? undefined\n        : tr(\n            \"auth.register.microsoftNotConfigured\",\n            \"Microsoft sign up is not configured\",\n          ),\n    },\n  ];\n\n  const verificationEmailMessage = tr(\n    \"auth.register.verificationEmailSentTo\",\n    \"We've sent a verification email to {{email}}. Please check your inbox and click the verification link to activate your account.\",\n  );\n  const [verificationEmailPrefix, verificationEmailSuffix = \"\"] =\n    verificationEmailMessage.split(\"{{email}}\");\n\n  // Show success state after signup\n  if (signupSuccess) {\n    return (\n      <AuthLayout\n        title={tr(\"auth.register.checkEmail\", \"Check your email\")}\n        subtitle={tr(\n          \"auth.register.verificationLinkSent\",\n          \"We've sent you a verification link\",\n        )}\n      >\n        <div className=\"flex flex-col items-center justify-center py-6\">\n          {/* Success Icon */}\n          <div className=\"w-20 h-20 rounded-full bg-status-success-bg-subtle flex items-center justify-center mb-6\">\n            <svg\n              className=\"w-10 h-10 text-status-success-text\"\n              fill=\"none\"\n              viewBox=\"0 0 24 24\"\n              stroke=\"currentColor\"\n            >\n              <path\n                strokeLinecap=\"round\"\n                strokeLinejoin=\"round\"\n                strokeWidth={2}\n                d=\"M3 8l7.89 5.26a2 2 0 002.22 0L21 8M5 19h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z\"\n              />\n            </svg>\n          </div>\n\n          <h3 className=\"text-lg font-semibold text-[var(--color-text-primary)] mb-2\">\n            {tr(\n              \"auth.register.accountCreated\",\n              \"Account created successfully!\",\n            )}\n          </h3>\n\n          <p className=\"text-center text-[var(--color-text-secondary)] mb-8 max-w-sm\">\n            {verificationEmailPrefix}\n            <span className=\"font-medium text-[var(--color-text-primary)]\">\n              {formData.email}\n            </span>\n            {verificationEmailSuffix}\n          </p>\n\n          <div className=\"space-y-3 w-full\">\n            <button\n              onClick={() => navigate(\"/auth/login\")}\n              className=\"auth-primary-button w-full px-4 py-3 font-semibold\"\n            >\n              {tr(\"auth.register.continueToSignIn\", \"Continue to sign in\")}\n            </button>\n\n            {resendError && (\n              <p className=\"text-center text-sm text-status-error-text\">\n                {resendError}\n              </p>\n            )}\n            <p className=\"text-center text-sm text-[var(--color-text-tertiary)]\">\n              {tr(\n                \"auth.register.didntReceiveEmail\",\n                \"Didn't receive the email? Check your spam folder or\",\n              )}{\" \"}\n              <button\n                disabled={isResendingVerification}\n                onClick={async () => {\n                  setResendError(null);\n                  setIsResendingVerification(true);\n                  try {\n                    await resendVerification(formData.email);\n                  } catch (err) {\n                    setResendError(\n                      err instanceof Error\n                        ? err.message\n                        : tr(\n                            \"auth.register.resendFailed\",\n                            \"Failed to resend verification email\",\n                          ),\n                    );\n                  } finally {\n                    setIsResendingVerification(false);\n                  }\n                }}\n                className=\"text-text-link hover:text-text-linkHover font-medium disabled:opacity-50 disabled:cursor-not-allowed\"\n              >\n                {isResendingVerification\n                  ? tr(\"auth.register.resending\", \"resending...\")\n                  : tr(\"auth.register.tryAgain\", \"try again\")}\n              </button>\n            </p>\n          </div>\n        </div>\n      </AuthLayout>\n    );\n  }\n\n  return (\n    <AuthLayout\n      title={tr(\"auth.register.createAccount\", \"Create your account\")}\n      subtitle={tr(\n        \"auth.register.startJourney\",\n        \"Start your journey with {{productName}}\",\n      ).replace(\"{{productName}}\", productName || \"Burdenoff Workspaces\")}\n      productName={productName}\n    >\n      <form onSubmit={handleSubmit} className=\"space-y-5\">\n        {/* Error Alert */}\n        {(error || validationErrors.length > 0) && (\n          <div className=\"flex items-start gap-3 p-4 rounded-xl bg-status-error-bg-subtle border border-status-error-border\">\n            <AlertIcon className=\"w-5 h-5 text-status-error-text flex-shrink-0 mt-0.5\" />\n            <div className=\"space-y-1\">\n              {error && (\n                <p className=\"text-sm text-status-error-text\">{error}</p>\n              )}\n              {validationErrors.map((err, i) => (\n                <p key={i} className=\"text-sm text-status-error-text\">\n                  {err}\n                </p>\n              ))}\n            </div>\n          </div>\n        )}\n\n        {/* Name Fields */}\n        <div className=\"grid grid-cols-2 gap-4\">\n          <div className=\"space-y-2\">\n            <label\n              htmlFor=\"firstName\"\n              className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n            >\n              {tr(\"auth.register.firstName\", \"First Name\")}\n            </label>\n            <input\n              id=\"firstName\"\n              type=\"text\"\n              required\n              aria-required=\"true\"\n              value={formData.firstName}\n              onChange={(e) =>\n                setFormData({ ...formData, firstName: e.target.value })\n              }\n              className=\"block w-full px-4 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\n                \"auth.register.firstNamePlaceholder\",\n                \"Enter first name\",\n              )}\n            />\n          </div>\n          <div className=\"space-y-2\">\n            <label\n              htmlFor=\"lastName\"\n              className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n            >\n              {tr(\"auth.register.lastName\", \"Last Name\")}\n            </label>\n            <input\n              id=\"lastName\"\n              type=\"text\"\n              required\n              aria-required=\"true\"\n              value={formData.lastName}\n              onChange={(e) =>\n                setFormData({ ...formData, lastName: e.target.value })\n              }\n              className=\"block w-full px-4 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\n                \"auth.register.lastNamePlaceholder\",\n                \"Enter last name\",\n              )}\n            />\n          </div>\n        </div>\n\n        {/* Username Input */}\n        <div className=\"space-y-2\">\n          <label\n            htmlFor=\"username\"\n            className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n          >\n            {tr(\"auth.register.username\", \"Username\")}\n          </label>\n          <div className=\"relative\">\n            <div className=\"absolute inset-y-0 left-0 pl-3.5 flex items-center pointer-events-none\">\n              <UserIcon className=\"w-5 h-5 text-[var(--color-text-tertiary)]\" />\n            </div>\n            <input\n              id=\"username\"\n              type=\"text\"\n              required\n              aria-required=\"true\"\n              autoComplete=\"username\"\n              value={formData.username}\n              onChange={(e) =>\n                setFormData({ ...formData, username: e.target.value })\n              }\n              className=\"block w-full pl-[3.5rem] pr-4 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\n                \"auth.register.usernamePlaceholder\",\n                \"Choose a username\",\n              )}\n            />\n          </div>\n        </div>\n\n        {/* Email Input */}\n        <div className=\"space-y-2\">\n          <label\n            htmlFor=\"email\"\n            className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n          >\n            {tr(\"auth.register.email\", \"Email\")}\n          </label>\n          <div className=\"relative\">\n            <div className=\"absolute inset-y-0 left-0 pl-3.5 flex items-center pointer-events-none\">\n              <EmailIcon className=\"w-5 h-5 text-[var(--color-text-tertiary)]\" />\n            </div>\n            <input\n              id=\"email\"\n              type=\"email\"\n              required\n              aria-required=\"true\"\n              autoComplete=\"email\"\n              value={formData.email}\n              onChange={(e) =>\n                setFormData({ ...formData, email: e.target.value })\n              }\n              className=\"block w-full pl-[3.5rem] pr-4 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\n                \"auth.register.emailPlaceholder\",\n                \"you@example.com\",\n              )}\n            />\n          </div>\n        </div>\n\n        {/* Password Input */}\n        <div className=\"space-y-2\">\n          <label\n            htmlFor=\"password\"\n            className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n          >\n            {tr(\"auth.register.password\", \"Password\")}\n          </label>\n          <div className=\"relative\">\n            <div className=\"absolute inset-y-0 left-0 pl-3.5 flex items-center pointer-events-none\">\n              <LockIcon className=\"w-5 h-5 text-[var(--color-text-tertiary)]\" />\n            </div>\n            <input\n              id=\"password\"\n              type={showPassword ? \"text\" : \"password\"}\n              required\n              aria-required=\"true\"\n              autoComplete=\"new-password\"\n              value={formData.password}\n              onChange={(e) =>\n                setFormData({ ...formData, password: e.target.value })\n              }\n              className=\"block w-full pl-[3.5rem] pr-12 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\n                \"auth.register.passwordPlaceholder\",\n                \"Create a strong password\",\n              )}\n            />\n            <button\n              type=\"button\"\n              onClick={() => setShowPassword(!showPassword)}\n              aria-label={showPassword ? \"Hide password\" : \"Show password\"}\n              className=\"absolute inset-y-0 right-0 pr-3.5 flex items-center text-[var(--color-text-tertiary)] hover:text-[var(--color-text-secondary)] transition-colors\"\n            >\n              {showPassword ? (\n                <EyeOffIcon className=\"w-5 h-5\" />\n              ) : (\n                <EyeIcon className=\"w-5 h-5\" />\n              )}\n            </button>\n          </div>\n\n          {/* Password Strength Indicator */}\n          {formData.password && (\n            <div className=\"space-y-3 pt-2\">\n              {/* Strength Bar */}\n              <div className=\"space-y-1\">\n                <div className=\"h-1.5 bg-[var(--color-bg-sunken)] rounded-full overflow-hidden\">\n                  <div\n                    className={`h-full ${passwordStrength.color} ${passwordStrength.width} transition-all duration-300`}\n                  />\n                </div>\n                <p className=\"text-xs text-[var(--color-text-tertiary)] capitalize\">\n                  {tr(\"auth.register.passwordStrength\", \"Password strength:\")}{\" \"}\n                  <span className=\"font-medium\">{passwordStrength.level}</span>\n                </p>\n              </div>\n\n              {/* Requirements Checklist */}\n              <div className=\"grid grid-cols-2 gap-2\">\n                {passwordChecks.map((check, i) => (\n                  <div key={i} className=\"flex items-center gap-2\">\n                    {check.met ? (\n                      <CheckIcon className=\"w-4 h-4 text-status-success-text\" />\n                    ) : (\n                      <XIcon className=\"w-4 h-4 text-[var(--color-text-tertiary)]\" />\n                    )}\n                    <span\n                      className={`text-xs ${\n                        check.met\n                          ? \"text-status-success-text\"\n                          : \"text-[var(--color-text-tertiary)]\"\n                      }`}\n                    >\n                      {check.label}\n                    </span>\n                  </div>\n                ))}\n              </div>\n            </div>\n          )}\n        </div>\n\n        {/* Terms Agreement */}\n        <p className=\"text-xs text-[var(--color-text-tertiary)] leading-relaxed\">\n          {tr(\n            \"auth.register.agreeToTerms\",\n            \"By creating an account, you agree to our\",\n          )}{\" \"}\n          <a href=\"/legal/terms\" className=\"text-text-link hover:underline\">\n            {tr(\"auth.register.termsOfService\", \"Terms of Service\")}\n          </a>{\" \"}\n          {tr(\"auth.register.and\", \"and\")}{\" \"}\n          <a href=\"/legal/privacy\" className=\"text-text-link hover:underline\">\n            {tr(\"auth.register.privacyPolicy\", \"Privacy Policy\")}\n          </a>\n          .\n        </p>\n\n        {/* reCAPTCHA v2 Checkbox */}\n        <CaptchaV2 onVerify={setCaptchaToken} />\n\n        {/* Submit Button */}\n        <button\n          type=\"submit\"\n          disabled={isLoading}\n          className=\"auth-primary-button flex w-full items-center justify-center gap-2 px-4 py-3 font-semibold\"\n        >\n          {isLoading ? (\n            <>\n              <SpinnerIcon className=\"w-5 h-5 animate-spin\" />\n              <span>\n                {tr(\"auth.register.creatingAccount\", \"Creating account...\")}\n              </span>\n            </>\n          ) : (\n            tr(\"auth.register.createAccountBtn\", \"Create account\")\n          )}\n        </button>\n      </form>\n\n      {/* Divider */}\n      <div className=\"relative my-8\">\n        <div className=\"absolute inset-0 flex items-center\">\n          <div className=\"w-full border-t border-[var(--color-border-default)]\" />\n        </div>\n        <div className=\"relative flex justify-center\">\n          <span className=\"px-4 bg-[var(--color-bg-canvas)] text-sm text-[var(--color-text-tertiary)]\">\n            {tr(\"auth.register.orSignUpWith\", \"or sign up with\")}\n          </span>\n        </div>\n      </div>\n\n      {/* OAuth Error */}\n      {oauthError && (\n        <div className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-error-bg-subtle border-status-error-border\">\n          <AlertIcon className=\"w-5 h-5 flex-shrink-0 mt-0.5 text-status-error-text\" />\n          <p className=\"text-sm text-status-error-text\">{oauthError}</p>\n        </div>\n      )}\n\n      {/* OAuth Buttons */}\n      <div className=\"grid grid-cols-3 gap-3\">\n        {oauthProviders.map((provider) => (\n          <button\n            key={provider.name}\n            type=\"button\"\n            onClick={provider.onClick}\n            disabled={provider.disabled}\n            title={provider.tooltip}\n            className={`flex items-center justify-center gap-2 px-4 py-3 rounded-xl border transition-all duration-200 group ${\n              provider.disabled\n                ? \"border-[var(--color-border-subtle)] bg-[var(--color-bg-disabled)] cursor-not-allowed opacity-50\"\n                : \"border-[var(--color-border-default)] bg-[var(--color-bg-surface)] hover:bg-[var(--color-bg-sunken)] hover:border-[var(--color-border-strong)]\"\n            }`}\n          >\n            <provider.icon\n              className={`w-5 h-5 ${provider.disabled ? \"opacity-50\" : \"\"}`}\n            />\n            <span\n              className={`sr-only sm:not-sr-only text-sm font-medium transition-colors hidden sm:inline ${\n                provider.disabled\n                  ? \"text-[var(--color-text-disabled)]\"\n                  : \"text-[var(--color-text-secondary)] group-hover:text-[var(--color-text-primary)]\"\n              }`}\n            >\n              {provider.name}\n            </span>\n          </button>\n        ))}\n      </div>\n\n      {/* Sign In Link */}\n      <p className=\"mt-8 text-center text-sm text-[var(--color-text-secondary)]\">\n        {tr(\"auth.register.alreadyHaveAccount\", \"Already have an account?\")}{\" \"}\n        <button\n          onClick={() => navigate(\"/auth/login\")}\n          className=\"font-semibold text-text-link hover:text-text-linkHover transition-colors\"\n        >\n          {tr(\"auth.register.signIn\", \"Sign in\")}\n        </button>\n      </p>\n    </AuthLayout>\n  );\n}\n"],"mappings":";;;;;;;;;;;;AA4BA,SAAgB,IAAe;CAC7B,IAAM,EAAE,mBAAgB,GAAS,EAC3B,IAAW,GAAa,EACxB,EAAE,SAAM,GAAS,EACjB,KAAM,GAAa,MAA6B;EACpD,IAAM,IAAa,EAAE,EAAI;AACzB,SAAO,MAAe,IAAM,IAAW;IAEnC,EAAE,YAAQ,wBAAoB,iBAAc,GAAmB,EAC/D,EAAE,wBAAqB,2BAAwB,4BACnD,GAAoB,EAChB,CAAC,GAAc,KAAmB,EAAS,GAAM,EACjD,CAAC,GAAU,KAAe,EAAsB;EACpD,OAAO;EACP,UAAU;EACV,UAAU;EACV,WAAW;EACX,UAAU;EACX,CAAC,EACI,CAAC,GAAkB,KAAuB,EAAmB,EAAE,CAAC,EAChE,CAAC,GAAe,KAAoB,EAAS,GAAM,EACnD,CAAC,GAAO,KAAY,EAAwB,KAAK,EACjD,CAAC,GAAY,KAAiB,EAAwB,KAAK,EAC3D,CAAC,GAAc,KAAmB,EAAwB,KAAK,EAC/D,CAAC,GAAyB,KAA8B,EAAS,GAAM,EACvE,CAAC,GAAa,KAAkB,EAAwB,KAAK,EAG7D,WAAwB;EAC5B,IAAM,IAAW,EAAS;AAC1B,SAAO;GACL;IACE,OAAO,EAAG,wBAAwB,yBAAyB;IAC3D,KAAK,EAAS,UAAU;IACzB;GACD;IACE,OAAO,EAAG,6BAA6B,uBAAuB;IAC9D,KAAK,QAAQ,KAAK,EAAS;IAC5B;GACD;IACE,OAAO,EAAG,6BAA6B,uBAAuB;IAC9D,KAAK,QAAQ,KAAK,EAAS;IAC5B;GACD;IACE,OAAO,EAAG,0BAA0B,aAAa;IACjD,KAAK,KAAK,KAAK,EAAS;IACzB;GACD;IACE,OAAO,EAAG,2BAA2B,wBAAwB;IAC7D,KAAK,yBAAyB,KAAK,EAAS;IAC7C;GACF;KACC,EAEE,WAA0B;EAC9B,IAAM,IAAW,EAAe,QAAQ,MAAM,EAAE,IAAI,CAAC;AAmBrD,SAlBI,KAAY,IACP;GACL,OAAO,EAAG,sCAAsC,OAAO;GACvD,OAAO;GACP,OAAO;GACR,GACC,KAAY,IACP;GACL,OAAO,EAAG,sCAAsC,OAAO;GACvD,OAAO;GACP,OAAO;GACR,GACC,KAAY,IACP;GACL,OAAO,EAAG,sCAAsC,OAAO;GACvD,OAAO;GACP,OAAO;GACR,GACI;GACL,OAAO,EAAG,wCAAwC,SAAS;GAC3D,OAAO;GACP,OAAO;GACR;KACC,EAEE,KAAe,OAAO,MAAuB;AACjD,IAAE,gBAAgB;EAElB,IAAM,IAAmB,EAAE;AAc3B,EAbK,GAAc,EAAS,MAAM,IAChC,EAAO,KACL,EAAG,8BAA8B,qCAAqC,CACvE,GAEC,CAAC,EAAS,YAAY,EAAS,SAAS,SAAS,MACnD,EAAO,KACL,EACE,8BACA,yCACD,CACF,EAEE,mBAAmB,KAAK,EAAS,SAAS,IAC7C,EAAO,KACL,EACE,+BACA,uEACD,CACF;EAEH,IAAM,IAAqB,EAAiB,EAAS,SAAS;AAc9D,MAbK,EAAmB,SACtB,EAAO,KAAK,GAAG,EAAmB,OAAO,EAGvC,GAAkB,IAAI,CAAC,KACzB,EAAO,KACL,EACE,iCACA,6CACD,CACF,EAGC,EAAO,SAAS,GAAG;AACrB,KAAoB,EAAO;AAC3B;;AAIF,EADA,EAAoB,EAAE,CAAC,EACvB,EAAS,KAAK;AACd,MAAI;AAOF,GANA,MAAM,GAAO;IACX,GAAG;IACH,GAAI,IAAe,EAAE,gBAAgB,GAAc,GAAG,EAAE;IACzD,CAAC,EAGF,EAAiB,GAAK;WACf,GAAK;AAMZ,GADA,EAHE,aAAe,QACX,EAAI,UACJ,EAAG,8BAA8B,iBAAiB,CACvC,EACjB,QAAQ,MAAM,mBAAmB,EAAI;;IAOnC,WAA2B;AAC/B,IAAc,KAAK;AACnB,MAAI;AACF,MAAqB;WACd,GAAK;AACZ,KACE,aAAe,QACX,EAAI,UACJ,EACE,oCACA,oCACD,CACN;;IAOC,UAA8B;AAClC,IAAc,KAAK;AACnB,MAAI;AACF,MAAwB;WACjB,GAAK;AACZ,KACE,aAAe,QACX,EAAI,UACJ,EACE,uCACA,uCACD,CACN;;IAKC,IAAqB,EAAqB,SAAS,EACnD,IAAwB,EAAqB,YAAY,EAEzD,KAAiB;EACrB;GACE,MAAM;GACN,MAAM;GACN,SAAS;GACT,UAAU,CAAC;GACX,SAAS,IACL,KAAA,IACA,EACE,qCACA,mCACD;GACN;EACD;GACE,MAAM;GACN,MAAM;GACN,eAAe;GACf,UAAU;GACV,SAAS,EACP,qCACA,mCACD;GACF;EACD;GACE,MAAM;GACN,MAAM;GACN,SAAS;GACT,UAAU,CAAC;GACX,SAAS,IACL,KAAA,IACA,EACE,wCACA,sCACD;GACN;EACF,EAMK,CAAC,IAAyB,KAA0B,MAJzB,EAC/B,yCACA,kIACD,CAE0B,MAAM,YAAY;AAgG7C,QA7FI,IAEA,kBAAC,GAAD;EACE,OAAO,EAAG,4BAA4B,mBAAmB;EACzD,UAAU,EACR,sCACA,qCACD;YAED,kBAAC,OAAD;GAAK,WAAU;aAAf;IAEE,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,OAAD;MACE,WAAU;MACV,MAAK;MACL,SAAQ;MACR,QAAO;gBAEP,kBAAC,QAAD;OACE,eAAc;OACd,gBAAe;OACf,aAAa;OACb,GAAE;OACF,CAAA;MACE,CAAA;KACF,CAAA;IAEN,kBAAC,MAAD;KAAI,WAAU;eACX,EACC,gCACA,gCACD;KACE,CAAA;IAEL,kBAAC,KAAD;KAAG,WAAU;eAAb;MACG;MACD,kBAAC,QAAD;OAAM,WAAU;iBACb,EAAS;OACL,CAAA;MACN;MACC;;IAEJ,kBAAC,OAAD;KAAK,WAAU;eAAf;MACE,kBAAC,UAAD;OACE,eAAe,EAAS,cAAc;OACtC,WAAU;iBAET,EAAG,kCAAkC,sBAAsB;OACrD,CAAA;MAER,KACC,kBAAC,KAAD;OAAG,WAAU;iBACV;OACC,CAAA;MAEN,kBAAC,KAAD;OAAG,WAAU;iBAAb;QACG,EACC,mCACA,sDACD;QAAE;QACH,kBAAC,UAAD;SACE,UAAU;SACV,SAAS,YAAY;AAEnB,UADA,EAAe,KAAK,EACpB,EAA2B,GAAK;AAChC,cAAI;AACF,iBAAM,GAAmB,EAAS,MAAM;mBACjC,GAAK;AACZ,aACE,aAAe,QACX,EAAI,UACJ,EACE,8BACA,sCACD,CACN;oBACO;AACR,aAA2B,GAAM;;;SAGrC,WAAU;mBAET,IACG,EAAG,2BAA2B,eAAe,GAC7C,EAAG,0BAA0B,YAAY;SACtC,CAAA;QACP;;MACA;;IACF;;EACK,CAAA,GAKf,kBAAC,GAAD;EACE,OAAO,EAAG,+BAA+B,sBAAsB;EAC/D,UAAU,EACR,8BACA,0CACD,CAAC,QAAQ,mBAAmB,KAAe,uBAAuB;EACtD;YANf;GAQE,kBAAC,QAAD;IAAM,UAAU;IAAc,WAAU;cAAxC;MAEI,KAAS,EAAiB,SAAS,MACnC,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,GAAD,EAAW,WAAU,uDAAwD,CAAA,EAC7E,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACG,KACC,kBAAC,KAAD;QAAG,WAAU;kBAAkC;QAAU,CAAA,EAE1D,EAAiB,KAAK,GAAK,MAC1B,kBAAC,KAAD;QAAW,WAAU;kBAClB;QACC,EAFI,EAEJ,CACJ,CACE;SACF;;KAIR,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACE,kBAAC,SAAD;QACE,SAAQ;QACR,WAAU;kBAET,EAAG,2BAA2B,aAAa;QACtC,CAAA,EACR,kBAAC,SAAD;QACE,IAAG;QACH,MAAK;QACL,UAAA;QACA,iBAAc;QACd,OAAO,EAAS;QAChB,WAAW,MACT,EAAY;SAAE,GAAG;SAAU,WAAW,EAAE,OAAO;SAAO,CAAC;QAEzD,WAAU;QACV,aAAa,EACX,sCACA,mBACD;QACD,CAAA,CACE;UACN,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACE,kBAAC,SAAD;QACE,SAAQ;QACR,WAAU;kBAET,EAAG,0BAA0B,YAAY;QACpC,CAAA,EACR,kBAAC,SAAD;QACE,IAAG;QACH,MAAK;QACL,UAAA;QACA,iBAAc;QACd,OAAO,EAAS;QAChB,WAAW,MACT,EAAY;SAAE,GAAG;SAAU,UAAU,EAAE,OAAO;SAAO,CAAC;QAExD,WAAU;QACV,aAAa,EACX,qCACA,kBACD;QACD,CAAA,CACE;SACF;;KAGN,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,SAAD;OACE,SAAQ;OACR,WAAU;iBAET,EAAG,0BAA0B,WAAW;OACnC,CAAA,EACR,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACE,kBAAC,OAAD;QAAK,WAAU;kBACb,kBAAC,GAAD,EAAU,WAAU,6CAA8C,CAAA;QAC9D,CAAA,EACN,kBAAC,SAAD;QACE,IAAG;QACH,MAAK;QACL,UAAA;QACA,iBAAc;QACd,cAAa;QACb,OAAO,EAAS;QAChB,WAAW,MACT,EAAY;SAAE,GAAG;SAAU,UAAU,EAAE,OAAO;SAAO,CAAC;QAExD,WAAU;QACV,aAAa,EACX,qCACA,oBACD;QACD,CAAA,CACE;SACF;;KAGN,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,SAAD;OACE,SAAQ;OACR,WAAU;iBAET,EAAG,uBAAuB,QAAQ;OAC7B,CAAA,EACR,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACE,kBAAC,OAAD;QAAK,WAAU;kBACb,kBAAC,GAAD,EAAW,WAAU,6CAA8C,CAAA;QAC/D,CAAA,EACN,kBAAC,SAAD;QACE,IAAG;QACH,MAAK;QACL,UAAA;QACA,iBAAc;QACd,cAAa;QACb,OAAO,EAAS;QAChB,WAAW,MACT,EAAY;SAAE,GAAG;SAAU,OAAO,EAAE,OAAO;SAAO,CAAC;QAErD,WAAU;QACV,aAAa,EACX,kCACA,kBACD;QACD,CAAA,CACE;SACF;;KAGN,kBAAC,OAAD;MAAK,WAAU;gBAAf;OACE,kBAAC,SAAD;QACE,SAAQ;QACR,WAAU;kBAET,EAAG,0BAA0B,WAAW;QACnC,CAAA;OACR,kBAAC,OAAD;QAAK,WAAU;kBAAf;SACE,kBAAC,OAAD;UAAK,WAAU;oBACb,kBAAC,GAAD,EAAU,WAAU,6CAA8C,CAAA;UAC9D,CAAA;SACN,kBAAC,SAAD;UACE,IAAG;UACH,MAAM,IAAe,SAAS;UAC9B,UAAA;UACA,iBAAc;UACd,cAAa;UACb,OAAO,EAAS;UAChB,WAAW,MACT,EAAY;WAAE,GAAG;WAAU,UAAU,EAAE,OAAO;WAAO,CAAC;UAExD,WAAU;UACV,aAAa,EACX,qCACA,2BACD;UACD,CAAA;SACF,kBAAC,UAAD;UACE,MAAK;UACL,eAAe,EAAgB,CAAC,EAAa;UAC7C,cAAY,IAAe,kBAAkB;UAC7C,WAAU;oBAGR,EADD,IACE,IAEA,GAFD,EAAY,WAAU,WAAY,CAEH;UAE1B,CAAA;SACL;;OAGL,EAAS,YACR,kBAAC,OAAD;QAAK,WAAU;kBAAf,CAEE,kBAAC,OAAD;SAAK,WAAU;mBAAf,CACE,kBAAC,OAAD;UAAK,WAAU;oBACb,kBAAC,OAAD,EACE,WAAW,UAAU,EAAiB,MAAM,GAAG,EAAiB,MAAM,+BACtE,CAAA;UACE,CAAA,EACN,kBAAC,KAAD;UAAG,WAAU;oBAAb;WACG,EAAG,kCAAkC,qBAAqB;WAAE;WAC7D,kBAAC,QAAD;YAAM,WAAU;sBAAe,EAAiB;YAAa,CAAA;WAC3D;YACA;YAGN,kBAAC,OAAD;SAAK,WAAU;mBACZ,EAAe,KAAK,GAAO,MAC1B,kBAAC,OAAD;UAAa,WAAU;oBAAvB,CACG,EAAM,MACL,kBAAC,GAAD,EAAW,WAAU,oCAAqC,CAAA,GAE1D,kBAAC,IAAD,EAAO,WAAU,6CAA8C,CAAA,EAEjE,kBAAC,QAAD;WACE,WAAW,WACT,EAAM,MACF,6BACA;qBAGL,EAAM;WACF,CAAA,CACH;YAfI,EAeJ,CACN;SACE,CAAA,CACF;;OAEJ;;KAGN,kBAAC,KAAD;MAAG,WAAU;gBAAb;OACG,EACC,8BACA,2CACD;OAAE;OACH,kBAAC,KAAD;QAAG,MAAK;QAAe,WAAU;kBAC9B,EAAG,gCAAgC,mBAAmB;QACrD,CAAA;OAAC;OACJ,EAAG,qBAAqB,MAAM;OAAE;OACjC,kBAAC,KAAD;QAAG,MAAK;QAAiB,WAAU;kBAChC,EAAG,+BAA+B,iBAAiB;QAClD,CAAA;;OAEF;;KAGJ,kBAAC,IAAD,EAAW,UAAU,GAAmB,CAAA;KAGxC,kBAAC,UAAD;MACE,MAAK;MACL,UAAU;MACV,WAAU;gBAET,IACC,kBAAA,GAAA,EAAA,UAAA,CACE,kBAAC,GAAD,EAAa,WAAU,wBAAyB,CAAA,EAChD,kBAAC,QAAD,EAAA,UACG,EAAG,iCAAiC,sBAAsB,EACtD,CAAA,CACN,EAAA,CAAA,GAEH,EAAG,kCAAkC,iBAAiB;MAEjD,CAAA;KACJ;;GAGP,kBAAC,OAAD;IAAK,WAAU;cAAf,CACE,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,OAAD,EAAK,WAAU,wDAAyD,CAAA;KACpE,CAAA,EACN,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,QAAD;MAAM,WAAU;gBACb,EAAG,8BAA8B,kBAAkB;MAC/C,CAAA;KACH,CAAA,CACF;;GAGL,KACC,kBAAC,OAAD;IAAK,WAAU;cAAf,CACE,kBAAC,GAAD,EAAW,WAAU,uDAAwD,CAAA,EAC7E,kBAAC,KAAD;KAAG,WAAU;eAAkC;KAAe,CAAA,CAC1D;;GAIR,kBAAC,OAAD;IAAK,WAAU;cACZ,GAAe,KAAK,MACnB,kBAAC,UAAD;KAEE,MAAK;KACL,SAAS,EAAS;KAClB,UAAU,EAAS;KACnB,OAAO,EAAS;KAChB,WAAW,wGACT,EAAS,WACL,oGACA;eATR,CAYE,kBAAC,EAAS,MAAV,EACE,WAAW,WAAW,EAAS,WAAW,eAAe,MACzD,CAAA,EACF,kBAAC,QAAD;MACE,WAAW,iFACT,EAAS,WACL,sCACA;gBAGL,EAAS;MACL,CAAA,CACA;OAvBF,EAAS,KAuBP,CACT;IACE,CAAA;GAGN,kBAAC,KAAD;IAAG,WAAU;cAAb;KACG,EAAG,oCAAoC,2BAA2B;KAAE;KACrE,kBAAC,UAAD;MACE,eAAe,EAAS,cAAc;MACtC,WAAU;gBAET,EAAG,wBAAwB,UAAU;MAC/B,CAAA;KACP;;GACO"}
+{"version":3,"file":"RegisterPage.js","names":[],"sources":["../../../src/auth/pages/RegisterPage.tsx"],"sourcesContent":["import { useState } from \"react\";\nimport { useNavigate } from \"react-router-dom\";\nimport { useI18n } from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport { validateEmail, validatePassword } from \"../utils/validation\";\nimport { useAuthOperations } from \"../hooks/useAuthOperations\";\nimport { useOAuthOperations } from \"../hooks/useOAuthOperations\";\nimport { AuthLayout } from \"../components/AuthLayout\";\nimport {\n  EmailIcon,\n  LockIcon,\n  UserIcon,\n  EyeIcon,\n  EyeOffIcon,\n  AlertIcon,\n  CheckIcon,\n  XIcon,\n  SpinnerIcon,\n  GoogleIcon,\n  GitHubIcon,\n  MicrosoftIcon,\n} from \"../components/AuthIcons\";\nimport { useAuth } from \"../providers/AuthProvider\";\nimport { CaptchaV2 } from \"../components/CaptchaV2\";\nimport { isCaptchaEnabled } from \"../utils/captchaConfig\";\nimport type { SignUpInput } from \"../types\";\n\n/**\n * Registration page with professional design\n */\nexport function RegisterPage() {\n  const { productName } = useAuth();\n  const navigate = useNavigate();\n  const { t } = useI18n();\n  const tr = (key: string, fallback: string): string => {\n    const translated = t(key);\n    return translated === key ? fallback : translated;\n  };\n  const { signUp, resendVerification, isLoading } = useAuthOperations();\n  const { initiateGoogleOAuth, initiateMicrosoftOAuth, isProviderConfigured } =\n    useOAuthOperations();\n  const [showPassword, setShowPassword] = useState(false);\n  const [formData, setFormData] = useState<SignUpInput>({\n    email: \"\",\n    username: \"\",\n    password: \"\",\n    firstName: \"\",\n    lastName: \"\",\n  });\n  const [validationErrors, setValidationErrors] = useState<string[]>([]);\n  const [signupSuccess, setSignupSuccess] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const [oauthError, setOauthError] = useState<string | null>(null);\n  const [captchaToken, setCaptchaToken] = useState<string | null>(null);\n  const [isResendingVerification, setIsResendingVerification] = useState(false);\n  const [resendError, setResendError] = useState<string | null>(null);\n\n  // Password strength indicators\n  const passwordChecks = (() => {\n    const password = formData.password;\n    return [\n      {\n        label: tr(\"auth.register.pwMin8\", \"At least 12 characters\"),\n        met: password.length >= 12,\n      },\n      {\n        label: tr(\"auth.register.pwUppercase\", \"One uppercase letter\"),\n        met: /[A-Z]/.test(password),\n      },\n      {\n        label: tr(\"auth.register.pwLowercase\", \"One lowercase letter\"),\n        met: /[a-z]/.test(password),\n      },\n      {\n        label: tr(\"auth.register.pwNumber\", \"One number\"),\n        met: /\\d/.test(password),\n      },\n      {\n        label: tr(\"auth.register.pwSpecial\", \"One special character\"),\n        met: /[!@#$%^&*(),.?\":{}|<>]/.test(password),\n      },\n    ];\n  })();\n\n  const passwordStrength = (() => {\n    const metCount = passwordChecks.filter((c) => c.met).length;\n    if (metCount <= 2)\n      return {\n        level: tr(\"auth.register.passwordStrengthWeak\", \"weak\"),\n        color: \"bg-status-error-bg-subtle0\",\n        width: \"w-1/4\",\n      };\n    if (metCount <= 3)\n      return {\n        level: tr(\"auth.register.passwordStrengthFair\", \"fair\"),\n        color: \"bg-status-warning-text\",\n        width: \"w-2/4\",\n      };\n    if (metCount <= 4)\n      return {\n        level: tr(\"auth.register.passwordStrengthGood\", \"good\"),\n        color: \"bg-status-warning-bg-subtle0\",\n        width: \"w-3/4\",\n      };\n    return {\n      level: tr(\"auth.register.passwordStrengthStrong\", \"strong\"),\n      color: \"bg-status-success-text\",\n      width: \"w-full\",\n    };\n  })();\n\n  const handleSubmit = async (e: React.FormEvent) => {\n    e.preventDefault();\n\n    const errors: string[] = [];\n    if (!validateEmail(formData.email)) {\n      errors.push(\n        tr(\"auth.register.invalidEmail\", \"Please enter a valid email address\"),\n      );\n    }\n    if (!formData.username || formData.username.length < 3) {\n      errors.push(\n        tr(\n          \"auth.register.usernameMin3\",\n          \"Username must be at least 3 characters\",\n        ),\n      );\n    }\n    if (!/^[a-zA-Z0-9_-]+$/.test(formData.username)) {\n      errors.push(\n        tr(\n          \"auth.register.usernameChars\",\n          \"Username can only contain letters, numbers, underscores, and hyphens\",\n        ),\n      );\n    }\n    const passwordValidation = validatePassword(formData.password);\n    if (!passwordValidation.valid) {\n      errors.push(...passwordValidation.errors);\n    }\n\n    if (isCaptchaEnabled() && !captchaToken) {\n      errors.push(\n        tr(\n          \"auth.register.completeCaptcha\",\n          \"Please complete the reCAPTCHA verification\",\n        ),\n      );\n    }\n\n    if (errors.length > 0) {\n      setValidationErrors(errors);\n      return;\n    }\n\n    setValidationErrors([]);\n    setError(null);\n    try {\n      await signUp({\n        ...formData,\n        ...(captchaToken ? { recaptchaToken: captchaToken } : {}),\n      });\n      // Sign up successful - check if email verification is required\n      // (Backend returns empty tokens when email verification is needed)\n      setSignupSuccess(true);\n    } catch (err) {\n      const message =\n        err instanceof Error\n          ? err.message\n          : tr(\"auth.register.signUpFailed\", \"Sign up failed\");\n      setError(message);\n      console.error(\"Sign up failed:\", err);\n    }\n  };\n\n  /**\n   * Handle Google OAuth signup\n   */\n  const handleGoogleSignup = () => {\n    setOauthError(null);\n    try {\n      initiateGoogleOAuth();\n    } catch (err) {\n      setOauthError(\n        err instanceof Error\n          ? err.message\n          : tr(\n              \"auth.register.googleSignUpFailed\",\n              \"Failed to initiate Google sign up\",\n            ),\n      );\n    }\n  };\n\n  /**\n   * Handle Microsoft OAuth signup\n   */\n  const handleMicrosoftSignup = () => {\n    setOauthError(null);\n    try {\n      initiateMicrosoftOAuth();\n    } catch (err) {\n      setOauthError(\n        err instanceof Error\n          ? err.message\n          : tr(\n              \"auth.register.microsoftSignUpFailed\",\n              \"Failed to initiate Microsoft sign up\",\n            ),\n      );\n    }\n  };\n\n  // Check if OAuth providers are configured\n  const isGoogleConfigured = isProviderConfigured(\"google\");\n  const isMicrosoftConfigured = isProviderConfigured(\"microsoft\");\n\n  const oauthProviders = [\n    {\n      name: \"Google\",\n      icon: GoogleIcon,\n      onClick: handleGoogleSignup,\n      disabled: !isGoogleConfigured,\n      tooltip: isGoogleConfigured\n        ? undefined\n        : tr(\n            \"auth.register.googleNotConfigured\",\n            \"Google sign up is not configured\",\n          ),\n    },\n    {\n      name: \"GitHub\",\n      icon: GitHubIcon,\n      onClick: () => {},\n      disabled: true,\n      tooltip: tr(\n        \"auth.register.githubNotConfigured\",\n        \"GitHub sign up is not configured\",\n      ),\n    },\n    {\n      name: \"Microsoft\",\n      icon: MicrosoftIcon,\n      onClick: handleMicrosoftSignup,\n      disabled: !isMicrosoftConfigured,\n      tooltip: isMicrosoftConfigured\n        ? undefined\n        : tr(\n            \"auth.register.microsoftNotConfigured\",\n            \"Microsoft sign up is not configured\",\n          ),\n    },\n  ];\n\n  const verificationEmailMessage = tr(\n    \"auth.register.verificationEmailSentTo\",\n    \"We've sent a verification email to {{email}}. Please check your inbox and click the verification link to activate your account.\",\n  );\n  const [verificationEmailPrefix, verificationEmailSuffix = \"\"] =\n    verificationEmailMessage.split(\"{{email}}\");\n\n  // Show success state after signup\n  if (signupSuccess) {\n    return (\n      <AuthLayout\n        title={tr(\"auth.register.checkEmail\", \"Check your email\")}\n        subtitle={tr(\n          \"auth.register.verificationLinkSent\",\n          \"We've sent you a verification link\",\n        )}\n      >\n        <div className=\"flex flex-col items-center justify-center py-6\">\n          {/* Success Icon */}\n          <div className=\"size-20 rounded-full bg-status-success-bg-subtle flex items-center justify-center mb-6\">\n            <svg\n              className=\"size-10 text-status-success-text\"\n              fill=\"none\"\n              viewBox=\"0 0 24 24\"\n              stroke=\"currentColor\"\n            >\n              <path\n                strokeLinecap=\"round\"\n                strokeLinejoin=\"round\"\n                strokeWidth={2}\n                d=\"M3 8l7.89 5.26a2 2 0 002.22 0L21 8M5 19h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z\"\n              />\n            </svg>\n          </div>\n\n          <h3 className=\"text-lg font-semibold text-[var(--color-text-primary)] mb-2\">\n            {tr(\n              \"auth.register.accountCreated\",\n              \"Account created successfully!\",\n            )}\n          </h3>\n\n          <p className=\"text-center text-[var(--color-text-secondary)] mb-8 max-w-sm\">\n            {verificationEmailPrefix}\n            <span className=\"font-medium text-[var(--color-text-primary)]\">\n              {formData.email}\n            </span>\n            {verificationEmailSuffix}\n          </p>\n\n          <div className=\"space-y-3 w-full\">\n            <button type=\"button\"\n              onClick={() => navigate(\"/auth/login\")}\n              className=\"auth-primary-button w-full px-4 py-3 font-semibold\"\n            >\n              {tr(\"auth.register.continueToSignIn\", \"Continue to sign in\")}\n            </button>\n\n            {resendError && (\n              <p className=\"text-center text-sm text-status-error-text\">\n                {resendError}\n              </p>\n            )}\n            <p className=\"text-center text-sm text-[var(--color-text-tertiary)]\">\n              {tr(\n                \"auth.register.didntReceiveEmail\",\n                \"Didn't receive the email? Check your spam folder or\",\n              )}{\" \"}\n              <button type=\"button\"\n                disabled={isResendingVerification}\n                onClick={async () => {\n                  setResendError(null);\n                  setIsResendingVerification(true);\n                  try {\n                    await resendVerification(formData.email);\n                  } catch (err) {\n                    setResendError(\n                      err instanceof Error\n                        ? err.message\n                        : tr(\n                            \"auth.register.resendFailed\",\n                            \"Failed to resend verification email\",\n                          ),\n                    );\n                  } finally {\n                    setIsResendingVerification(false);\n                  }\n                }}\n                className=\"text-text-link hover:text-text-linkHover font-medium disabled:opacity-50 disabled:cursor-not-allowed\"\n              >\n                {isResendingVerification\n                  ? tr(\"auth.register.resending\", \"resending...\")\n                  : tr(\"auth.register.tryAgain\", \"try again\")}\n              </button>\n            </p>\n          </div>\n        </div>\n      </AuthLayout>\n    );\n  }\n\n  return (\n    <AuthLayout\n      title={tr(\"auth.register.createAccount\", \"Create your account\")}\n      subtitle={tr(\n        \"auth.register.startJourney\",\n        \"Start your journey with {{productName}}\",\n      ).replace(\"{{productName}}\", productName || \"Burdenoff Workspaces\")}\n      productName={productName}\n    >\n      <form onSubmit={handleSubmit} className=\"space-y-5\">\n        {/* Error Alert */}\n        {(error || validationErrors.length > 0) && (\n          <div className=\"flex items-start gap-3 p-4 rounded-xl bg-status-error-bg-subtle border border-status-error-border\">\n            <AlertIcon className=\"size-5 text-status-error-text flex-shrink-0 mt-0.5\" />\n            <div className=\"space-y-1\">\n              {error && (\n                <p className=\"text-sm text-status-error-text\">{error}</p>\n              )}\n              {validationErrors.map((err) => (\n                <p key={err} className=\"text-sm text-status-error-text\">\n                  {err}\n                </p>\n              ))}\n            </div>\n          </div>\n        )}\n\n        {/* Name Fields */}\n        <div className=\"grid grid-cols-2 gap-4\">\n          <div className=\"space-y-2\">\n            <label\n              htmlFor=\"firstName\"\n              className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n            >\n              {tr(\"auth.register.firstName\", \"First Name\")}\n            </label>\n            <input\n              id=\"firstName\"\n              type=\"text\"\n              required\n              aria-required=\"true\"\n              aria-label={tr(\"auth.register.firstName\", \"First Name\")}\n              value={formData.firstName}\n              onChange={(e) =>\n                setFormData({ ...formData, firstName: e.target.value })\n              }\n              className=\"block w-full px-4 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\n                \"auth.register.firstNamePlaceholder\",\n                \"Enter first name\",\n              )}\n            />\n          </div>\n          <div className=\"space-y-2\">\n            <label\n              htmlFor=\"lastName\"\n              className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n            >\n              {tr(\"auth.register.lastName\", \"Last Name\")}\n            </label>\n            <input\n              id=\"lastName\"\n              type=\"text\"\n              required\n              aria-required=\"true\"\n              aria-label={tr(\"auth.register.lastName\", \"Last Name\")}\n              value={formData.lastName}\n              onChange={(e) =>\n                setFormData({ ...formData, lastName: e.target.value })\n              }\n              className=\"block w-full px-4 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\n                \"auth.register.lastNamePlaceholder\",\n                \"Enter last name\",\n              )}\n            />\n          </div>\n        </div>\n\n        {/* Username Input */}\n        <div className=\"space-y-2\">\n          <label\n            htmlFor=\"username\"\n            className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n          >\n            {tr(\"auth.register.username\", \"Username\")}\n          </label>\n          <div className=\"relative\">\n            <div className=\"absolute inset-y-0 left-0 pl-3.5 flex items-center pointer-events-none\">\n              <UserIcon className=\"size-5 text-[var(--color-text-tertiary)]\" />\n            </div>\n            <input\n              id=\"username\"\n              type=\"text\"\n              required\n              aria-required=\"true\"\n              aria-label={tr(\"auth.register.username\", \"Username\")}\n              autoComplete=\"username\"\n              value={formData.username}\n              onChange={(e) =>\n                setFormData({ ...formData, username: e.target.value })\n              }\n              className=\"block w-full pl-[3.5rem] pr-4 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\n                \"auth.register.usernamePlaceholder\",\n                \"Choose a username\",\n              )}\n            />\n          </div>\n        </div>\n\n        {/* Email Input */}\n        <div className=\"space-y-2\">\n          <label\n            htmlFor=\"email\"\n            className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n          >\n            {tr(\"auth.register.email\", \"Email\")}\n          </label>\n          <div className=\"relative\">\n            <div className=\"absolute inset-y-0 left-0 pl-3.5 flex items-center pointer-events-none\">\n              <EmailIcon className=\"size-5 text-[var(--color-text-tertiary)]\" />\n            </div>\n            <input\n              id=\"email\"\n              type=\"email\"\n              required\n              aria-required=\"true\"\n              aria-label={tr(\"auth.register.email\", \"Email\")}\n              autoComplete=\"email\"\n              value={formData.email}\n              onChange={(e) =>\n                setFormData({ ...formData, email: e.target.value })\n              }\n              className=\"block w-full pl-[3.5rem] pr-4 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\n                \"auth.register.emailPlaceholder\",\n                \"you@example.com\",\n              )}\n            />\n          </div>\n        </div>\n\n        {/* Password Input */}\n        <div className=\"space-y-2\">\n          <label\n            htmlFor=\"password\"\n            className=\"block text-sm font-medium text-[var(--color-text-primary)]\"\n          >\n            {tr(\"auth.register.password\", \"Password\")}\n          </label>\n          <div className=\"relative\">\n            <div className=\"absolute inset-y-0 left-0 pl-3.5 flex items-center pointer-events-none\">\n              <LockIcon className=\"size-5 text-[var(--color-text-tertiary)]\" />\n            </div>\n            <input\n              id=\"password\"\n              type={showPassword ? \"text\" : \"password\"}\n              required\n              aria-required=\"true\"\n              aria-label={tr(\"auth.register.password\", \"Password\")}\n              autoComplete=\"new-password\"\n              value={formData.password}\n              onChange={(e) =>\n                setFormData({ ...formData, password: e.target.value })\n              }\n              className=\"block w-full pl-[3.5rem] pr-12 py-3 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] placeholder:text-[var(--color-text-tertiary)] focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all\"\n              placeholder={tr(\n                \"auth.register.passwordPlaceholder\",\n                \"Create a strong password\",\n              )}\n            />\n            <button\n              type=\"button\"\n              onClick={() => setShowPassword(!showPassword)}\n              aria-label={showPassword ? \"Hide password\" : \"Show password\"}\n              className=\"absolute inset-y-0 right-0 pr-3.5 flex items-center text-[var(--color-text-tertiary)] hover:text-[var(--color-text-secondary)] transition-colors\"\n            >\n              {showPassword ? (\n                <EyeOffIcon className=\"size-5\" />\n              ) : (\n                <EyeIcon className=\"size-5\" />\n              )}\n            </button>\n          </div>\n\n          {/* Password Strength Indicator */}\n          {formData.password && (\n            <div className=\"space-y-3 pt-2\">\n              {/* Strength Bar */}\n              <div className=\"space-y-1\">\n                <div className=\"h-1.5 bg-[var(--color-bg-sunken)] rounded-full overflow-hidden\">\n                  <div\n                    className={`h-full ${passwordStrength.color} ${passwordStrength.width} transition-all duration-300`}\n                  />\n                </div>\n                <p className=\"text-xs text-[var(--color-text-tertiary)] capitalize\">\n                  {tr(\"auth.register.passwordStrength\", \"Password strength:\")}{\" \"}\n                  <span className=\"font-medium\">{passwordStrength.level}</span>\n                </p>\n              </div>\n\n              {/* Requirements Checklist */}\n              <div className=\"grid grid-cols-2 gap-2\">\n                {passwordChecks.map((check) => (\n                  <div key={check.label} className=\"flex items-center gap-2\">\n                    {check.met ? (\n                      <CheckIcon className=\"size-4 text-status-success-text\" />\n                    ) : (\n                      <XIcon className=\"size-4 text-[var(--color-text-tertiary)]\" />\n                    )}\n                    <span\n                      className={`text-xs ${\n                        check.met\n                          ? \"text-status-success-text\"\n                          : \"text-[var(--color-text-tertiary)]\"\n                      }`}\n                    >\n                      {check.label}\n                    </span>\n                  </div>\n                ))}\n              </div>\n            </div>\n          )}\n        </div>\n\n        {/* Terms Agreement */}\n        <p className=\"text-xs text-[var(--color-text-tertiary)] leading-relaxed\">\n          {tr(\n            \"auth.register.agreeToTerms\",\n            \"By creating an account, you agree to our\",\n          )}{\" \"}\n          <a href=\"/legal/terms\" className=\"text-text-link hover:underline\">\n            {tr(\"auth.register.termsOfService\", \"Terms of Service\")}\n          </a>{\" \"}\n          {tr(\"auth.register.and\", \"and\")}{\" \"}\n          <a href=\"/legal/privacy\" className=\"text-text-link hover:underline\">\n            {tr(\"auth.register.privacyPolicy\", \"Privacy Policy\")}\n          </a>\n          .\n        </p>\n\n        {/* reCAPTCHA v2 Checkbox */}\n        <CaptchaV2 onVerify={setCaptchaToken} />\n\n        {/* Submit Button */}\n        <button\n          type=\"submit\"\n          disabled={isLoading}\n          className=\"auth-primary-button flex w-full items-center justify-center gap-2 px-4 py-3 font-semibold\"\n        >\n          {isLoading ? (\n            <>\n              <SpinnerIcon className=\"size-5 animate-spin\" />\n              <span>\n                {tr(\"auth.register.creatingAccount\", \"Creating account...\")}\n              </span>\n            </>\n          ) : (\n            tr(\"auth.register.createAccountBtn\", \"Create account\")\n          )}\n        </button>\n      </form>\n\n      {/* Divider */}\n      <div className=\"relative my-8\">\n        <div className=\"absolute inset-0 flex items-center\">\n          <div className=\"w-full border-t border-[var(--color-border-default)]\" />\n        </div>\n        <div className=\"relative flex justify-center\">\n          <span className=\"px-4 bg-[var(--color-bg-canvas)] text-sm text-[var(--color-text-tertiary)]\">\n            {tr(\"auth.register.orSignUpWith\", \"or sign up with\")}\n          </span>\n        </div>\n      </div>\n\n      {/* OAuth Error */}\n      {oauthError && (\n        <div className=\"flex items-start gap-3 p-4 rounded-xl border bg-status-error-bg-subtle border-status-error-border\">\n          <AlertIcon className=\"size-5 flex-shrink-0 mt-0.5 text-status-error-text\" />\n          <p className=\"text-sm text-status-error-text\">{oauthError}</p>\n        </div>\n      )}\n\n      {/* OAuth Buttons */}\n      <div className=\"grid grid-cols-3 gap-3\">\n        {oauthProviders.map((provider) => (\n          <button\n            key={provider.name}\n            type=\"button\"\n            onClick={provider.onClick}\n            disabled={provider.disabled}\n            title={provider.tooltip}\n            className={`flex items-center justify-center gap-2 px-4 py-3 rounded-xl border transition-all duration-200 group ${\n              provider.disabled\n                ? \"border-[var(--color-border-subtle)] bg-[var(--color-bg-disabled)] cursor-not-allowed opacity-50\"\n                : \"border-[var(--color-border-default)] bg-[var(--color-bg-surface)] hover:bg-[var(--color-bg-sunken)] hover:border-[var(--color-border-strong)]\"\n            }`}\n          >\n            <provider.icon\n              className={`size-5 ${provider.disabled ? \"opacity-50\" : \"\"}`}\n            />\n            <span\n              className={`sr-only sm:not-sr-only text-sm font-medium transition-colors hidden sm:inline ${\n                provider.disabled\n                  ? \"text-[var(--color-text-disabled)]\"\n                  : \"text-[var(--color-text-secondary)] group-hover:text-[var(--color-text-primary)]\"\n              }`}\n            >\n              {provider.name}\n            </span>\n          </button>\n        ))}\n      </div>\n\n      {/* Sign In Link */}\n      <p className=\"mt-8 text-center text-sm text-[var(--color-text-secondary)]\">\n        {tr(\"auth.register.alreadyHaveAccount\", \"Already have an account?\")}{\" \"}\n        <button type=\"button\"\n          onClick={() => navigate(\"/auth/login\")}\n          className=\"font-semibold text-text-link hover:text-text-linkHover transition-colors\"\n        >\n          {tr(\"auth.register.signIn\", \"Sign in\")}\n        </button>\n      </p>\n    </AuthLayout>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;AA6BA,SAAgB,IAAe;CAC7B,IAAM,EAAE,mBAAgB,GAAS,EAC3B,IAAW,GAAa,EACxB,EAAE,SAAM,GAAS,EACjB,KAAM,GAAa,MAA6B;EACpD,IAAM,IAAa,EAAE,EAAI;AACzB,SAAO,MAAe,IAAM,IAAW;IAEnC,EAAE,YAAQ,wBAAoB,iBAAc,GAAmB,EAC/D,EAAE,wBAAqB,2BAAwB,4BACnD,GAAoB,EAChB,CAAC,GAAc,KAAmB,EAAS,GAAM,EACjD,CAAC,GAAU,KAAe,EAAsB;EACpD,OAAO;EACP,UAAU;EACV,UAAU;EACV,WAAW;EACX,UAAU;EACX,CAAC,EACI,CAAC,GAAkB,KAAuB,EAAmB,EAAE,CAAC,EAChE,CAAC,GAAe,KAAoB,EAAS,GAAM,EACnD,CAAC,GAAO,KAAY,EAAwB,KAAK,EACjD,CAAC,GAAY,KAAiB,EAAwB,KAAK,EAC3D,CAAC,GAAc,KAAmB,EAAwB,KAAK,EAC/D,CAAC,GAAyB,KAA8B,EAAS,GAAM,EACvE,CAAC,GAAa,KAAkB,EAAwB,KAAK,EAG7D,WAAwB;EAC5B,IAAM,IAAW,EAAS;AAC1B,SAAO;GACL;IACE,OAAO,EAAG,wBAAwB,yBAAyB;IAC3D,KAAK,EAAS,UAAU;IACzB;GACD;IACE,OAAO,EAAG,6BAA6B,uBAAuB;IAC9D,KAAK,QAAQ,KAAK,EAAS;IAC5B;GACD;IACE,OAAO,EAAG,6BAA6B,uBAAuB;IAC9D,KAAK,QAAQ,KAAK,EAAS;IAC5B;GACD;IACE,OAAO,EAAG,0BAA0B,aAAa;IACjD,KAAK,KAAK,KAAK,EAAS;IACzB;GACD;IACE,OAAO,EAAG,2BAA2B,wBAAwB;IAC7D,KAAK,yBAAyB,KAAK,EAAS;IAC7C;GACF;KACC,EAEE,WAA0B;EAC9B,IAAM,IAAW,EAAe,QAAQ,MAAM,EAAE,IAAI,CAAC;AAmBrD,SAlBI,KAAY,IACP;GACL,OAAO,EAAG,sCAAsC,OAAO;GACvD,OAAO;GACP,OAAO;GACR,GACC,KAAY,IACP;GACL,OAAO,EAAG,sCAAsC,OAAO;GACvD,OAAO;GACP,OAAO;GACR,GACC,KAAY,IACP;GACL,OAAO,EAAG,sCAAsC,OAAO;GACvD,OAAO;GACP,OAAO;GACR,GACI;GACL,OAAO,EAAG,wCAAwC,SAAS;GAC3D,OAAO;GACP,OAAO;GACR;KACC,EAEE,KAAe,OAAO,MAAuB;AACjD,IAAE,gBAAgB;EAElB,IAAM,IAAmB,EAAE;AAc3B,EAbK,EAAc,EAAS,MAAM,IAChC,EAAO,KACL,EAAG,8BAA8B,qCAAqC,CACvE,GAEC,CAAC,EAAS,YAAY,EAAS,SAAS,SAAS,MACnD,EAAO,KACL,EACE,8BACA,yCACD,CACF,EAEE,mBAAmB,KAAK,EAAS,SAAS,IAC7C,EAAO,KACL,EACE,+BACA,uEACD,CACF;EAEH,IAAM,IAAqB,GAAiB,EAAS,SAAS;AAc9D,MAbK,EAAmB,SACtB,EAAO,KAAK,GAAG,EAAmB,OAAO,EAGvC,GAAkB,IAAI,CAAC,KACzB,EAAO,KACL,EACE,iCACA,6CACD,CACF,EAGC,EAAO,SAAS,GAAG;AACrB,KAAoB,EAAO;AAC3B;;AAIF,EADA,EAAoB,EAAE,CAAC,EACvB,EAAS,KAAK;AACd,MAAI;AAOF,GANA,MAAM,GAAO;IACX,GAAG;IACH,GAAI,IAAe,EAAE,gBAAgB,GAAc,GAAG,EAAE;IACzD,CAAC,EAGF,EAAiB,GAAK;WACf,GAAK;AAMZ,GADA,EAHE,aAAe,QACX,EAAI,UACJ,EAAG,8BAA8B,iBAAiB,CACvC,EACjB,QAAQ,MAAM,mBAAmB,EAAI;;IAOnC,WAA2B;AAC/B,IAAc,KAAK;AACnB,MAAI;AACF,MAAqB;WACd,GAAK;AACZ,KACE,aAAe,QACX,EAAI,UACJ,EACE,oCACA,oCACD,CACN;;IAOC,WAA8B;AAClC,IAAc,KAAK;AACnB,MAAI;AACF,MAAwB;WACjB,GAAK;AACZ,KACE,aAAe,QACX,EAAI,UACJ,EACE,uCACA,uCACD,CACN;;IAKC,IAAqB,EAAqB,SAAS,EACnD,IAAwB,EAAqB,YAAY,EAEzD,KAAiB;EACrB;GACE,MAAM;GACN,MAAM;GACN,SAAS;GACT,UAAU,CAAC;GACX,SAAS,IACL,KAAA,IACA,EACE,qCACA,mCACD;GACN;EACD;GACE,MAAM;GACN,MAAM;GACN,eAAe;GACf,UAAU;GACV,SAAS,EACP,qCACA,mCACD;GACF;EACD;GACE,MAAM;GACN,MAAM;GACN,SAAS;GACT,UAAU,CAAC;GACX,SAAS,IACL,KAAA,IACA,EACE,wCACA,sCACD;GACN;EACF,EAMK,CAAC,IAAyB,KAA0B,MAJzB,EAC/B,yCACA,kIACD,CAE0B,MAAM,YAAY;AAgG7C,QA7FI,IAEA,kBAAC,GAAD;EACE,OAAO,EAAG,4BAA4B,mBAAmB;EACzD,UAAU,EACR,sCACA,qCACD;YAED,kBAAC,OAAD;GAAK,WAAU;aAAf;IAEE,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,OAAD;MACE,WAAU;MACV,MAAK;MACL,SAAQ;MACR,QAAO;gBAEP,kBAAC,QAAD;OACE,eAAc;OACd,gBAAe;OACf,aAAa;OACb,GAAE;OACF,CAAA;MACE,CAAA;KACF,CAAA;IAEN,kBAAC,MAAD;KAAI,WAAU;eACX,EACC,gCACA,gCACD;KACE,CAAA;IAEL,kBAAC,KAAD;KAAG,WAAU;eAAb;MACG;MACD,kBAAC,QAAD;OAAM,WAAU;iBACb,EAAS;OACL,CAAA;MACN;MACC;;IAEJ,kBAAC,OAAD;KAAK,WAAU;eAAf;MACE,kBAAC,UAAD;OAAQ,MAAK;OACX,eAAe,EAAS,cAAc;OACtC,WAAU;iBAET,EAAG,kCAAkC,sBAAsB;OACrD,CAAA;MAER,KACC,kBAAC,KAAD;OAAG,WAAU;iBACV;OACC,CAAA;MAEN,kBAAC,KAAD;OAAG,WAAU;iBAAb;QACG,EACC,mCACA,sDACD;QAAE;QACH,kBAAC,UAAD;SAAQ,MAAK;SACX,UAAU;SACV,SAAS,YAAY;AAEnB,UADA,EAAe,KAAK,EACpB,EAA2B,GAAK;AAChC,cAAI;AACF,iBAAM,GAAmB,EAAS,MAAM;mBACjC,GAAK;AACZ,aACE,aAAe,QACX,EAAI,UACJ,EACE,8BACA,sCACD,CACN;oBACO;AACR,aAA2B,GAAM;;;SAGrC,WAAU;mBAET,IACG,EAAG,2BAA2B,eAAe,GAC7C,EAAG,0BAA0B,YAAY;SACtC,CAAA;QACP;;MACA;;IACF;;EACK,CAAA,GAKf,kBAAC,GAAD;EACE,OAAO,EAAG,+BAA+B,sBAAsB;EAC/D,UAAU,EACR,8BACA,0CACD,CAAC,QAAQ,mBAAmB,KAAe,uBAAuB;EACtD;YANf;GAQE,kBAAC,QAAD;IAAM,UAAU;IAAc,WAAU;cAAxC;MAEI,KAAS,EAAiB,SAAS,MACnC,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,GAAD,EAAW,WAAU,sDAAuD,CAAA,EAC5E,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACG,KACC,kBAAC,KAAD;QAAG,WAAU;kBAAkC;QAAU,CAAA,EAE1D,EAAiB,KAAK,MACrB,kBAAC,KAAD;QAAa,WAAU;kBACpB;QACC,EAFI,EAEJ,CACJ,CACE;SACF;;KAIR,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACE,kBAAC,SAAD;QACE,SAAQ;QACR,WAAU;kBAET,EAAG,2BAA2B,aAAa;QACtC,CAAA,EACR,kBAAC,SAAD;QACE,IAAG;QACH,MAAK;QACL,UAAA;QACA,iBAAc;QACd,cAAY,EAAG,2BAA2B,aAAa;QACvD,OAAO,EAAS;QAChB,WAAW,MACT,EAAY;SAAE,GAAG;SAAU,WAAW,EAAE,OAAO;SAAO,CAAC;QAEzD,WAAU;QACV,aAAa,EACX,sCACA,mBACD;QACD,CAAA,CACE;UACN,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACE,kBAAC,SAAD;QACE,SAAQ;QACR,WAAU;kBAET,EAAG,0BAA0B,YAAY;QACpC,CAAA,EACR,kBAAC,SAAD;QACE,IAAG;QACH,MAAK;QACL,UAAA;QACA,iBAAc;QACd,cAAY,EAAG,0BAA0B,YAAY;QACrD,OAAO,EAAS;QAChB,WAAW,MACT,EAAY;SAAE,GAAG;SAAU,UAAU,EAAE,OAAO;SAAO,CAAC;QAExD,WAAU;QACV,aAAa,EACX,qCACA,kBACD;QACD,CAAA,CACE;SACF;;KAGN,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,SAAD;OACE,SAAQ;OACR,WAAU;iBAET,EAAG,0BAA0B,WAAW;OACnC,CAAA,EACR,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACE,kBAAC,OAAD;QAAK,WAAU;kBACb,kBAAC,GAAD,EAAU,WAAU,4CAA6C,CAAA;QAC7D,CAAA,EACN,kBAAC,SAAD;QACE,IAAG;QACH,MAAK;QACL,UAAA;QACA,iBAAc;QACd,cAAY,EAAG,0BAA0B,WAAW;QACpD,cAAa;QACb,OAAO,EAAS;QAChB,WAAW,MACT,EAAY;SAAE,GAAG;SAAU,UAAU,EAAE,OAAO;SAAO,CAAC;QAExD,WAAU;QACV,aAAa,EACX,qCACA,oBACD;QACD,CAAA,CACE;SACF;;KAGN,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,SAAD;OACE,SAAQ;OACR,WAAU;iBAET,EAAG,uBAAuB,QAAQ;OAC7B,CAAA,EACR,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACE,kBAAC,OAAD;QAAK,WAAU;kBACb,kBAAC,GAAD,EAAW,WAAU,4CAA6C,CAAA;QAC9D,CAAA,EACN,kBAAC,SAAD;QACE,IAAG;QACH,MAAK;QACL,UAAA;QACA,iBAAc;QACd,cAAY,EAAG,uBAAuB,QAAQ;QAC9C,cAAa;QACb,OAAO,EAAS;QAChB,WAAW,MACT,EAAY;SAAE,GAAG;SAAU,OAAO,EAAE,OAAO;SAAO,CAAC;QAErD,WAAU;QACV,aAAa,EACX,kCACA,kBACD;QACD,CAAA,CACE;SACF;;KAGN,kBAAC,OAAD;MAAK,WAAU;gBAAf;OACE,kBAAC,SAAD;QACE,SAAQ;QACR,WAAU;kBAET,EAAG,0BAA0B,WAAW;QACnC,CAAA;OACR,kBAAC,OAAD;QAAK,WAAU;kBAAf;SACE,kBAAC,OAAD;UAAK,WAAU;oBACb,kBAAC,GAAD,EAAU,WAAU,4CAA6C,CAAA;UAC7D,CAAA;SACN,kBAAC,SAAD;UACE,IAAG;UACH,MAAM,IAAe,SAAS;UAC9B,UAAA;UACA,iBAAc;UACd,cAAY,EAAG,0BAA0B,WAAW;UACpD,cAAa;UACb,OAAO,EAAS;UAChB,WAAW,MACT,EAAY;WAAE,GAAG;WAAU,UAAU,EAAE,OAAO;WAAO,CAAC;UAExD,WAAU;UACV,aAAa,EACX,qCACA,2BACD;UACD,CAAA;SACF,kBAAC,UAAD;UACE,MAAK;UACL,eAAe,EAAgB,CAAC,EAAa;UAC7C,cAAY,IAAe,kBAAkB;UAC7C,WAAU;oBAGR,EADD,IACE,IAEA,GAFD,EAAY,WAAU,UAAW,CAEH;UAEzB,CAAA;SACL;;OAGL,EAAS,YACR,kBAAC,OAAD;QAAK,WAAU;kBAAf,CAEE,kBAAC,OAAD;SAAK,WAAU;mBAAf,CACE,kBAAC,OAAD;UAAK,WAAU;oBACb,kBAAC,OAAD,EACE,WAAW,UAAU,EAAiB,MAAM,GAAG,EAAiB,MAAM,+BACtE,CAAA;UACE,CAAA,EACN,kBAAC,KAAD;UAAG,WAAU;oBAAb;WACG,EAAG,kCAAkC,qBAAqB;WAAE;WAC7D,kBAAC,QAAD;YAAM,WAAU;sBAAe,EAAiB;YAAa,CAAA;WAC3D;YACA;YAGN,kBAAC,OAAD;SAAK,WAAU;mBACZ,EAAe,KAAK,MACnB,kBAAC,OAAD;UAAuB,WAAU;oBAAjC,CACG,EAAM,MACL,kBAAC,GAAD,EAAW,WAAU,mCAAoC,CAAA,GAEzD,kBAAC,IAAD,EAAO,WAAU,4CAA6C,CAAA,EAEhE,kBAAC,QAAD;WACE,WAAW,WACT,EAAM,MACF,6BACA;qBAGL,EAAM;WACF,CAAA,CACH;YAfI,EAAM,MAeV,CACN;SACE,CAAA,CACF;;OAEJ;;KAGN,kBAAC,KAAD;MAAG,WAAU;gBAAb;OACG,EACC,8BACA,2CACD;OAAE;OACH,kBAAC,KAAD;QAAG,MAAK;QAAe,WAAU;kBAC9B,EAAG,gCAAgC,mBAAmB;QACrD,CAAA;OAAC;OACJ,EAAG,qBAAqB,MAAM;OAAE;OACjC,kBAAC,KAAD;QAAG,MAAK;QAAiB,WAAU;kBAChC,EAAG,+BAA+B,iBAAiB;QAClD,CAAA;;OAEF;;KAGJ,kBAAC,GAAD,EAAW,UAAU,GAAmB,CAAA;KAGxC,kBAAC,UAAD;MACE,MAAK;MACL,UAAU;MACV,WAAU;gBAET,IACC,kBAAA,GAAA,EAAA,UAAA,CACE,kBAAC,GAAD,EAAa,WAAU,uBAAwB,CAAA,EAC/C,kBAAC,QAAD,EAAA,UACG,EAAG,iCAAiC,sBAAsB,EACtD,CAAA,CACN,EAAA,CAAA,GAEH,EAAG,kCAAkC,iBAAiB;MAEjD,CAAA;KACJ;;GAGP,kBAAC,OAAD;IAAK,WAAU;cAAf,CACE,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,OAAD,EAAK,WAAU,wDAAyD,CAAA;KACpE,CAAA,EACN,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,QAAD;MAAM,WAAU;gBACb,EAAG,8BAA8B,kBAAkB;MAC/C,CAAA;KACH,CAAA,CACF;;GAGL,KACC,kBAAC,OAAD;IAAK,WAAU;cAAf,CACE,kBAAC,GAAD,EAAW,WAAU,sDAAuD,CAAA,EAC5E,kBAAC,KAAD;KAAG,WAAU;eAAkC;KAAe,CAAA,CAC1D;;GAIR,kBAAC,OAAD;IAAK,WAAU;cACZ,GAAe,KAAK,MACnB,kBAAC,UAAD;KAEE,MAAK;KACL,SAAS,EAAS;KAClB,UAAU,EAAS;KACnB,OAAO,EAAS;KAChB,WAAW,wGACT,EAAS,WACL,oGACA;eATR,CAYE,kBAAC,EAAS,MAAV,EACE,WAAW,UAAU,EAAS,WAAW,eAAe,MACxD,CAAA,EACF,kBAAC,QAAD;MACE,WAAW,iFACT,EAAS,WACL,sCACA;gBAGL,EAAS;MACL,CAAA,CACA;OAvBF,EAAS,KAuBP,CACT;IACE,CAAA;GAGN,kBAAC,KAAD;IAAG,WAAU;cAAb;KACG,EAAG,oCAAoC,2BAA2B;KAAE;KACrE,kBAAC,UAAD;MAAQ,MAAK;MACX,eAAe,EAAS,cAAc;MACtC,WAAU;gBAET,EAAG,wBAAwB,UAAU;MAC/B,CAAA;KACP;;GACO"}

package/dist/auth/pages/SSOClearPage.js

@@ -30,7 +30,7 @@ function l() {
 		window.location.replace(e);
 	}, [o]), /* @__PURE__ */ r("div", {
 		className: "flex items-center justify-center min-h-screen bg-bg-canvas",
-		children: /* @__PURE__ */ r("div", { className: "animate-spin rounded-full h-8 w-8 border-2 border-action-primary-bg border-t-transparent" })
+		children: /* @__PURE__ */ r("div", { className: "animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent" })
 	});
 }
 //#endregion

package/dist/auth/pages/SSOClearPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SSOClearPage.js","names":[],"sources":["../../../src/auth/pages/SSOClearPage.tsx"],"sourcesContent":["/**\n * SSOClearPage — Cross-Domain Logout at the Central Bridge Host\n *\n * Companion to SSODepositPage. When a user signs out on a product origin,\n * the product app cleared its own localStorage / cookies but the bridge\n * host (alphaapp/app.burdenoff.com) still held the deposited session in\n * first-party (unpartitioned) localStorage. A later visit to any product\n * would then bridge-host-relay that stale session back, effectively\n * undoing the logout.\n *\n * AuthProvider.logout() / logoutAll() on a non-bridge-host origin redirect\n * here via a top-level navigation:\n *\n *   product.com (logout)\n *     → app.burdenoff.com/auth/sso-clear?returnTo=<encoded-return-url>\n *         — wipes bridge-host localStorage + bf-sso cookie\n *     → <returnTo>\n *\n * URL: /auth/sso-clear\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { clearShellSsoCookies } from \"@burdenoff/fe-libs/shared/utils\";\nimport { clearLocalAuthState } from \"@burdenoff/fe-libs/shared/components\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n  if (url.protocol !== \"https:\") return false;\n  for (const domain of ALLOWED_RETURN_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n  if (!returnTo) return \"/auth/login?reason=logout\";\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n      return url.href;\n    }\n  } catch {\n    /* ignore */\n  }\n  return \"/auth/login?reason=logout\";\n}\n\nexport function SSOClearPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n\n    try {\n      clearLocalAuthState();\n      clearShellSsoCookies();\n      // Broadcast to any same-origin shells still listening so they drop the\n      // session immediately too (best-effort — only fires on the bridge\n      // host's origin, which is the only place where iframe storage isn't\n      // partitioned cross-product).\n      getAuthBridge()?.notifyLogoutAll();\n    } catch {\n      /* ignore — proceed with the redirect regardless */\n    }\n\n    window.location.replace(returnTo);\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full h-8 w-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;;;;AA2BA,IAAM,IAAyB,IAAI,IAAI,qkBAkCtC,CAAC;AAEF,SAAS,EAAmB,GAAmB;AAE7C,KADI,EAAI,aAAa,eAAe,EAAI,aAAa,eACjD,EAAI,SAAS,SAAS,uBAAuB,CAAE,QAAO;AAC1D,KAAI,EAAI,aAAa,SAAU,QAAO;AACtC,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAC7B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAe;CAC7B,IAAM,CAAC,KAAgB,GAAiB;AAoBxC,QAlBA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC;AAEhE,MAAI;AAOF,GANA,GAAqB,EACrB,GAAsB,EAKtB,GAAe,EAAE,iBAAiB;UAC5B;AAIR,SAAO,SAAS,QAAQ,EAAS;IAChC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,4FAA6F,CAAA;EACxG,CAAA"}
+{"version":3,"file":"SSOClearPage.js","names":[],"sources":["../../../src/auth/pages/SSOClearPage.tsx"],"sourcesContent":["/**\n * SSOClearPage — Cross-Domain Logout at the Central Bridge Host\n *\n * Companion to SSODepositPage. When a user signs out on a product origin,\n * the product app cleared its own localStorage / cookies but the bridge\n * host (alphaapp/app.burdenoff.com) still held the deposited session in\n * first-party (unpartitioned) localStorage. A later visit to any product\n * would then bridge-host-relay that stale session back, effectively\n * undoing the logout.\n *\n * AuthProvider.logout() / logoutAll() on a non-bridge-host origin redirect\n * here via a top-level navigation:\n *\n *   product.com (logout)\n *     → app.burdenoff.com/auth/sso-clear?returnTo=<encoded-return-url>\n *         — wipes bridge-host localStorage + bf-sso cookie\n *     → <returnTo>\n *\n * URL: /auth/sso-clear\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { clearShellSsoCookies } from \"@burdenoff/fe-libs/shared/utils\";\nimport { clearLocalAuthState } from \"@burdenoff/fe-libs/shared/components\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n  if (url.protocol !== \"https:\") return false;\n  for (const domain of ALLOWED_RETURN_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n  if (!returnTo) return \"/auth/login?reason=logout\";\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n      return url.href;\n    }\n  } catch {\n    /* ignore */\n  }\n  return \"/auth/login?reason=logout\";\n}\n\nexport function SSOClearPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n\n    try {\n      clearLocalAuthState();\n      clearShellSsoCookies();\n      // Broadcast to any same-origin shells still listening so they drop the\n      // session immediately too (best-effort — only fires on the bridge\n      // host's origin, which is the only place where iframe storage isn't\n      // partitioned cross-product).\n      getAuthBridge()?.notifyLogoutAll();\n    } catch {\n      /* ignore — proceed with the redirect regardless */\n    }\n\n    window.location.replace(returnTo);\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;;;;AA2BA,IAAM,IAAyB,IAAI,IAAI,qkBAkCtC,CAAC;AAEF,SAAS,EAAmB,GAAmB;AAE7C,KADI,EAAI,aAAa,eAAe,EAAI,aAAa,eACjD,EAAI,SAAS,SAAS,uBAAuB,CAAE,QAAO;AAC1D,KAAI,EAAI,aAAa,SAAU,QAAO;AACtC,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAC7B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAe;CAC7B,IAAM,CAAC,KAAgB,GAAiB;AAoBxC,QAlBA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC;AAEhE,MAAI;AAOF,GANA,GAAqB,EACrB,GAAsB,EAKtB,GAAe,EAAE,iBAAiB;UAC5B;AAIR,SAAO,SAAS,QAAQ,EAAS;IAChC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,2FAA4F,CAAA;EACvG,CAAA"}

package/dist/auth/pages/SSODepositPage.js

@@ -45,7 +45,7 @@ function l() {
 		}
 	}, [o]), /* @__PURE__ */ r("div", {
 		className: "flex items-center justify-center min-h-screen bg-bg-canvas",
-		children: /* @__PURE__ */ r("div", { className: "animate-spin rounded-full h-8 w-8 border-2 border-action-primary-bg border-t-transparent" })
+		children: /* @__PURE__ */ r("div", { className: "animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent" })
 	});
 }
 //#endregion

package/dist/auth/pages/SSODepositPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SSODepositPage.js","names":[],"sources":["../../../src/auth/pages/SSODepositPage.tsx"],"sourcesContent":["/**\n * SSODepositPage — Cross-Domain Token Deposit at the Central Bridge Host\n *\n * Loaded as a top-level navigation (NOT an iframe) on the bridge host\n * (alphaapp/app.burdenoff.com) right after a user signs in on any other\n * product origin. It receives the freshly-issued tokens in the URL fragment\n * (`#sso=<base64>` — fragments are never sent to servers) and stores them\n * in this origin's first-party (unpartitioned) localStorage so that:\n *\n *   1. A later top-level visit to the bridge host renders authenticated.\n *   2. Other product origins can discover the session via\n *      `/auth/sso-relay?returnTo=...` against this host.\n *\n * Flow:\n *   product.com/auth/login    → user signs in\n *   product.com               → POST-success redirect to:\n *   app.burdenoff.com/auth/sso-deposit?returnTo=<encoded-return-url>#sso=<base64>\n *                             → writes tokens here, sets bf-sso cookie\n *   <returnTo>                → user lands back at intended dashboard\n *\n * URL: /auth/sso-deposit\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\nimport { setSSoCookie } from \"@burdenoff/fe-libs/shared/utils\";\nimport { useAuthStore } from \"../store/authStore\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n  if (url.protocol !== \"https:\") return false;\n  for (const domain of ALLOWED_RETURN_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n  if (!returnTo) return \"/\";\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n      return url.href;\n    }\n  } catch {\n    /* ignore */\n  }\n  return \"/\";\n}\n\nexport function SSODepositPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n    const hash = window.location.hash;\n\n    if (!hash.startsWith(\"#sso=\")) {\n      window.location.replace(returnTo);\n      return;\n    }\n\n    try {\n      const encoded = hash.slice(5);\n      const payload = JSON.parse(atob(encoded)) as {\n        profileId?: string;\n        tokens?: string;\n        user?: string;\n        profiles?: string;\n      };\n      const { profileId, tokens, user, profiles } = payload;\n\n      if (!profileId || !tokens) {\n        window.location.replace(returnTo);\n        return;\n      }\n\n      // First-party (unpartitioned) writes on the bridge host origin —\n      // future top-level visits here see the session.\n      localStorage.setItem(`bf-p-${profileId}-tokens`, tokens);\n      if (user) {\n        localStorage.setItem(`bf-p-${profileId}-user`, user);\n      }\n      if (profiles) {\n        localStorage.setItem(\"bf-profiles\", profiles);\n      }\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      setSSoCookie(profileId);\n      useAuthStore.getState().loadFromProfile(profileId);\n      window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n\n      // Notify the same-origin auth bridge so any other open shells on\n      // this origin pick up the new session immediately.\n      getAuthBridge()?.notifyLogin({\n        user: user ? (JSON.parse(user) as Record<string, unknown>) : null,\n        tokens: tokens ? (JSON.parse(tokens) as { accessToken: string }) : null,\n        activeProfileId: profileId,\n        profiles: profiles\n          ? (JSON.parse(profiles) as Array<Record<string, unknown>>)\n          : [],\n      });\n\n      window.location.replace(returnTo);\n    } catch {\n      window.location.replace(returnTo);\n    }\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full h-8 w-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;;;;AA6BA,IAAM,IAAyB,IAAI,IAAI,qkBAkCtC,CAAC;AAEF,SAAS,EAAmB,GAAmB;AAE7C,KADI,EAAI,aAAa,eAAe,EAAI,aAAa,eACjD,EAAI,SAAS,SAAS,uBAAuB,CAAE,QAAO;AAC1D,KAAI,EAAI,aAAa,SAAU,QAAO;AACtC,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAC7B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAiB;CAC/B,IAAM,CAAC,KAAgB,GAAiB;AAyDxC,QAvDA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC,EAC1D,IAAO,OAAO,SAAS;AAE7B,MAAI,CAAC,EAAK,WAAW,QAAQ,EAAE;AAC7B,UAAO,SAAS,QAAQ,EAAS;AACjC;;AAGF,MAAI;GACF,IAAM,IAAU,EAAK,MAAM,EAAE,EAOvB,EAAE,cAAW,WAAQ,SAAM,gBANjB,KAAK,MAAM,KAAK,EAAQ,CAAC;AAQzC,OAAI,CAAC,KAAa,CAAC,GAAQ;AACzB,WAAO,SAAS,QAAQ,EAAS;AACjC;;AA4BF,GAvBA,aAAa,QAAQ,QAAQ,EAAU,UAAU,EAAO,EACpD,KACF,aAAa,QAAQ,QAAQ,EAAU,QAAQ,EAAK,EAElD,KACF,aAAa,QAAQ,eAAe,EAAS,EAE/C,eAAe,QAAQ,qBAAqB,EAAU,EACtD,EAAa,EAAU,EACvB,EAAa,UAAU,CAAC,gBAAgB,EAAU,EAClD,OAAO,cAAc,IAAI,MAAM,4BAA4B,CAAC,EAI5D,GAAe,EAAE,YAAY;IAC3B,MAAM,IAAQ,KAAK,MAAM,EAAK,GAA+B;IAC7D,QAAQ,IAAU,KAAK,MAAM,EAAO,GAA+B;IACnE,iBAAiB;IACjB,UAAU,IACL,KAAK,MAAM,EAAS,GACrB,EAAE;IACP,CAAC,EAEF,OAAO,SAAS,QAAQ,EAAS;UAC3B;AACN,UAAO,SAAS,QAAQ,EAAS;;IAElC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,4FAA6F,CAAA;EACxG,CAAA"}
+{"version":3,"file":"SSODepositPage.js","names":[],"sources":["../../../src/auth/pages/SSODepositPage.tsx"],"sourcesContent":["/**\n * SSODepositPage — Cross-Domain Token Deposit at the Central Bridge Host\n *\n * Loaded as a top-level navigation (NOT an iframe) on the bridge host\n * (alphaapp/app.burdenoff.com) right after a user signs in on any other\n * product origin. It receives the freshly-issued tokens in the URL fragment\n * (`#sso=<base64>` — fragments are never sent to servers) and stores them\n * in this origin's first-party (unpartitioned) localStorage so that:\n *\n *   1. A later top-level visit to the bridge host renders authenticated.\n *   2. Other product origins can discover the session via\n *      `/auth/sso-relay?returnTo=...` against this host.\n *\n * Flow:\n *   product.com/auth/login    → user signs in\n *   product.com               → POST-success redirect to:\n *   app.burdenoff.com/auth/sso-deposit?returnTo=<encoded-return-url>#sso=<base64>\n *                             → writes tokens here, sets bf-sso cookie\n *   <returnTo>                → user lands back at intended dashboard\n *\n * URL: /auth/sso-deposit\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\nimport { setSSoCookie } from \"@burdenoff/fe-libs/shared/utils\";\nimport { useAuthStore } from \"../store/authStore\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n  if (url.protocol !== \"https:\") return false;\n  for (const domain of ALLOWED_RETURN_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n  if (!returnTo) return \"/\";\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n      return url.href;\n    }\n  } catch {\n    /* ignore */\n  }\n  return \"/\";\n}\n\nexport function SSODepositPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n    const hash = window.location.hash;\n\n    if (!hash.startsWith(\"#sso=\")) {\n      window.location.replace(returnTo);\n      return;\n    }\n\n    try {\n      const encoded = hash.slice(5);\n      const payload = JSON.parse(atob(encoded)) as {\n        profileId?: string;\n        tokens?: string;\n        user?: string;\n        profiles?: string;\n      };\n      const { profileId, tokens, user, profiles } = payload;\n\n      if (!profileId || !tokens) {\n        window.location.replace(returnTo);\n        return;\n      }\n\n      // First-party (unpartitioned) writes on the bridge host origin —\n      // future top-level visits here see the session.\n      localStorage.setItem(`bf-p-${profileId}-tokens`, tokens);\n      if (user) {\n        localStorage.setItem(`bf-p-${profileId}-user`, user);\n      }\n      if (profiles) {\n        localStorage.setItem(\"bf-profiles\", profiles);\n      }\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      setSSoCookie(profileId);\n      useAuthStore.getState().loadFromProfile(profileId);\n      window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n\n      // Notify the same-origin auth bridge so any other open shells on\n      // this origin pick up the new session immediately.\n      getAuthBridge()?.notifyLogin({\n        user: user ? (JSON.parse(user) as Record<string, unknown>) : null,\n        tokens: tokens ? (JSON.parse(tokens) as { accessToken: string }) : null,\n        activeProfileId: profileId,\n        profiles: profiles\n          ? (JSON.parse(profiles) as Array<Record<string, unknown>>)\n          : [],\n      });\n\n      window.location.replace(returnTo);\n    } catch {\n      window.location.replace(returnTo);\n    }\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;;;;AA6BA,IAAM,IAAyB,IAAI,IAAI,qkBAkCtC,CAAC;AAEF,SAAS,EAAmB,GAAmB;AAE7C,KADI,EAAI,aAAa,eAAe,EAAI,aAAa,eACjD,EAAI,SAAS,SAAS,uBAAuB,CAAE,QAAO;AAC1D,KAAI,EAAI,aAAa,SAAU,QAAO;AACtC,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAC7B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAiB;CAC/B,IAAM,CAAC,KAAgB,GAAiB;AAyDxC,QAvDA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC,EAC1D,IAAO,OAAO,SAAS;AAE7B,MAAI,CAAC,EAAK,WAAW,QAAQ,EAAE;AAC7B,UAAO,SAAS,QAAQ,EAAS;AACjC;;AAGF,MAAI;GACF,IAAM,IAAU,EAAK,MAAM,EAAE,EAOvB,EAAE,cAAW,WAAQ,SAAM,gBANjB,KAAK,MAAM,KAAK,EAAQ,CAAC;AAQzC,OAAI,CAAC,KAAa,CAAC,GAAQ;AACzB,WAAO,SAAS,QAAQ,EAAS;AACjC;;AA4BF,GAvBA,aAAa,QAAQ,QAAQ,EAAU,UAAU,EAAO,EACpD,KACF,aAAa,QAAQ,QAAQ,EAAU,QAAQ,EAAK,EAElD,KACF,aAAa,QAAQ,eAAe,EAAS,EAE/C,eAAe,QAAQ,qBAAqB,EAAU,EACtD,EAAa,EAAU,EACvB,EAAa,UAAU,CAAC,gBAAgB,EAAU,EAClD,OAAO,cAAc,IAAI,MAAM,4BAA4B,CAAC,EAI5D,GAAe,EAAE,YAAY;IAC3B,MAAM,IAAQ,KAAK,MAAM,EAAK,GAA+B;IAC7D,QAAQ,IAAU,KAAK,MAAM,EAAO,GAA+B;IACnE,iBAAiB;IACjB,UAAU,IACL,KAAK,MAAM,EAAS,GACrB,EAAE;IACP,CAAC,EAEF,OAAO,SAAS,QAAQ,EAAS;UAC3B;AACN,UAAO,SAAS,QAAQ,EAAS;;IAElC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,2FAA4F,CAAA;EACvG,CAAA"}

package/dist/auth/pages/SSORelayCallbackPage.js

@@ -39,7 +39,7 @@ function s() {
 		}
 	}, [s]), /* @__PURE__ */ r("div", {
 		className: "flex items-center justify-center min-h-screen bg-bg-canvas",
-		children: /* @__PURE__ */ r("div", { className: "animate-spin rounded-full h-8 w-8 border-2 border-action-primary-bg border-t-transparent" })
+		children: /* @__PURE__ */ r("div", { className: "animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent" })
 	});
 }
 //#endregion

package/dist/auth/pages/SSORelayCallbackPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SSORelayCallbackPage.js","names":[],"sources":["../../../src/auth/pages/SSORelayCallbackPage.tsx"],"sourcesContent":["/**\n * SSORelayCallbackPage — Receives tokens from the SSO relay and stores them locally.\n *\n * Tokens arrive in the URL fragment (#sso=<base64>) which is never sent to servers.\n * After storing in localStorage, redirects to the returnTo path.\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\nimport { setSSoCookie } from \"@burdenoff/fe-libs/shared/utils\";\nimport { useAuthStore } from \"../store/authStore\";\n\nfunction getSafeReturnTo(returnTo: string | null): string {\n  if (!returnTo) return \"/dashboard\";\n\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin !== window.location.origin) return \"/dashboard\";\n    return `${url.pathname}${url.search}${url.hash}`;\n  } catch {\n    return \"/dashboard\";\n  }\n}\n\nexport function SSORelayCallbackPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = getSafeReturnTo(searchParams.get(\"returnTo\"));\n    const hash = window.location.hash;\n\n    if (!hash.startsWith(\"#sso=\")) {\n      // No SSO data — redirect to login\n      window.location.replace(\"/auth/login\");\n      return;\n    }\n\n    try {\n      const encoded = hash.slice(5); // Remove \"#sso=\"\n      const payload = JSON.parse(atob(encoded));\n      const { profileId, tokens, user, profiles } = payload;\n\n      if (!profileId || !tokens) {\n        window.location.replace(\"/auth/login\");\n        return;\n      }\n\n      // Store tokens in localStorage\n      localStorage.setItem(`bf-p-${profileId}-tokens`, tokens);\n      if (user) {\n        localStorage.setItem(`bf-p-${profileId}-user`, user);\n      }\n      if (profiles) {\n        localStorage.setItem(\"bf-profiles\", profiles);\n      }\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      setSSoCookie(profileId);\n      useAuthStore.getState().loadFromProfile(profileId);\n\n      // Dispatch event so AuthProvider picks up the new state\n      window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n\n      // Notify the auth bridge so other open shells can pick up the new session\n      getAuthBridge()?.notifyLogin({\n        user: user ? JSON.parse(user) : null,\n        tokens: tokens ? JSON.parse(tokens) : null,\n        activeProfileId: profileId,\n        profiles: profiles ? JSON.parse(profiles) : [],\n      });\n\n      // Clear the hash and redirect\n      window.location.replace(returnTo);\n    } catch {\n      window.location.replace(\"/auth/login\");\n    }\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full h-8 w-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;;;;AAaA,SAAS,EAAgB,GAAiC;AACxD,KAAI,CAAC,EAAU,QAAO;AAEtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AAErD,SADI,EAAI,WAAW,OAAO,SAAS,SAC5B,GAAG,EAAI,WAAW,EAAI,SAAS,EAAI,SADQ;SAE5C;AACN,SAAO;;;AAIX,SAAgB,IAAuB;CACrC,IAAM,CAAC,KAAgB,GAAiB;AAoDxC,QAlDA,QAAgB;EACd,IAAM,IAAW,EAAgB,EAAa,IAAI,WAAW,CAAC,EACxD,IAAO,OAAO,SAAS;AAE7B,MAAI,CAAC,EAAK,WAAW,QAAQ,EAAE;AAE7B,UAAO,SAAS,QAAQ,cAAc;AACtC;;AAGF,MAAI;GACF,IAAM,IAAU,EAAK,MAAM,EAAE,EAEvB,EAAE,cAAW,WAAQ,SAAM,gBADjB,KAAK,MAAM,KAAK,EAAQ,CAAC;AAGzC,OAAI,CAAC,KAAa,CAAC,GAAQ;AACzB,WAAO,SAAS,QAAQ,cAAc;AACtC;;AA2BF,GAvBA,aAAa,QAAQ,QAAQ,EAAU,UAAU,EAAO,EACpD,KACF,aAAa,QAAQ,QAAQ,EAAU,QAAQ,EAAK,EAElD,KACF,aAAa,QAAQ,eAAe,EAAS,EAE/C,eAAe,QAAQ,qBAAqB,EAAU,EACtD,EAAa,EAAU,EACvB,EAAa,UAAU,CAAC,gBAAgB,EAAU,EAGlD,OAAO,cAAc,IAAI,MAAM,4BAA4B,CAAC,EAG5D,GAAe,EAAE,YAAY;IAC3B,MAAM,IAAO,KAAK,MAAM,EAAK,GAAG;IAChC,QAAQ,IAAS,KAAK,MAAM,EAAO,GAAG;IACtC,iBAAiB;IACjB,UAAU,IAAW,KAAK,MAAM,EAAS,GAAG,EAAE;IAC/C,CAAC,EAGF,OAAO,SAAS,QAAQ,EAAS;UAC3B;AACN,UAAO,SAAS,QAAQ,cAAc;;IAEvC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,4FAA6F,CAAA;EACxG,CAAA"}
+{"version":3,"file":"SSORelayCallbackPage.js","names":[],"sources":["../../../src/auth/pages/SSORelayCallbackPage.tsx"],"sourcesContent":["/**\n * SSORelayCallbackPage — Receives tokens from the SSO relay and stores them locally.\n *\n * Tokens arrive in the URL fragment (#sso=<base64>) which is never sent to servers.\n * After storing in localStorage, redirects to the returnTo path.\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\nimport { setSSoCookie } from \"@burdenoff/fe-libs/shared/utils\";\nimport { useAuthStore } from \"../store/authStore\";\n\nfunction getSafeReturnTo(returnTo: string | null): string {\n  if (!returnTo) return \"/dashboard\";\n\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin !== window.location.origin) return \"/dashboard\";\n    return `${url.pathname}${url.search}${url.hash}`;\n  } catch {\n    return \"/dashboard\";\n  }\n}\n\nexport function SSORelayCallbackPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = getSafeReturnTo(searchParams.get(\"returnTo\"));\n    const hash = window.location.hash;\n\n    if (!hash.startsWith(\"#sso=\")) {\n      // No SSO data — redirect to login\n      window.location.replace(\"/auth/login\");\n      return;\n    }\n\n    try {\n      const encoded = hash.slice(5); // Remove \"#sso=\"\n      const payload = JSON.parse(atob(encoded));\n      const { profileId, tokens, user, profiles } = payload;\n\n      if (!profileId || !tokens) {\n        window.location.replace(\"/auth/login\");\n        return;\n      }\n\n      // Store tokens in localStorage\n      localStorage.setItem(`bf-p-${profileId}-tokens`, tokens);\n      if (user) {\n        localStorage.setItem(`bf-p-${profileId}-user`, user);\n      }\n      if (profiles) {\n        localStorage.setItem(\"bf-profiles\", profiles);\n      }\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      setSSoCookie(profileId);\n      useAuthStore.getState().loadFromProfile(profileId);\n\n      // Dispatch event so AuthProvider picks up the new state\n      window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n\n      // Notify the auth bridge so other open shells can pick up the new session\n      getAuthBridge()?.notifyLogin({\n        user: user ? JSON.parse(user) : null,\n        tokens: tokens ? JSON.parse(tokens) : null,\n        activeProfileId: profileId,\n        profiles: profiles ? JSON.parse(profiles) : [],\n      });\n\n      // Clear the hash and redirect\n      window.location.replace(returnTo);\n    } catch {\n      window.location.replace(\"/auth/login\");\n    }\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;;;;AAaA,SAAS,EAAgB,GAAiC;AACxD,KAAI,CAAC,EAAU,QAAO;AAEtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AAErD,SADI,EAAI,WAAW,OAAO,SAAS,SAC5B,GAAG,EAAI,WAAW,EAAI,SAAS,EAAI,SADQ;SAE5C;AACN,SAAO;;;AAIX,SAAgB,IAAuB;CACrC,IAAM,CAAC,KAAgB,GAAiB;AAoDxC,QAlDA,QAAgB;EACd,IAAM,IAAW,EAAgB,EAAa,IAAI,WAAW,CAAC,EACxD,IAAO,OAAO,SAAS;AAE7B,MAAI,CAAC,EAAK,WAAW,QAAQ,EAAE;AAE7B,UAAO,SAAS,QAAQ,cAAc;AACtC;;AAGF,MAAI;GACF,IAAM,IAAU,EAAK,MAAM,EAAE,EAEvB,EAAE,cAAW,WAAQ,SAAM,gBADjB,KAAK,MAAM,KAAK,EAAQ,CAAC;AAGzC,OAAI,CAAC,KAAa,CAAC,GAAQ;AACzB,WAAO,SAAS,QAAQ,cAAc;AACtC;;AA2BF,GAvBA,aAAa,QAAQ,QAAQ,EAAU,UAAU,EAAO,EACpD,KACF,aAAa,QAAQ,QAAQ,EAAU,QAAQ,EAAK,EAElD,KACF,aAAa,QAAQ,eAAe,EAAS,EAE/C,eAAe,QAAQ,qBAAqB,EAAU,EACtD,EAAa,EAAU,EACvB,EAAa,UAAU,CAAC,gBAAgB,EAAU,EAGlD,OAAO,cAAc,IAAI,MAAM,4BAA4B,CAAC,EAG5D,GAAe,EAAE,YAAY;IAC3B,MAAM,IAAO,KAAK,MAAM,EAAK,GAAG;IAChC,QAAQ,IAAS,KAAK,MAAM,EAAO,GAAG;IACtC,iBAAiB;IACjB,UAAU,IAAW,KAAK,MAAM,EAAS,GAAG,EAAE;IAC/C,CAAC,EAGF,OAAO,SAAS,QAAQ,EAAS;UAC3B;AACN,UAAO,SAAS,QAAQ,cAAc;;IAEvC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,2FAA4F,CAAA;EACvG,CAAA"}

package/dist/auth/pages/SSORelayPage.js

@@ -2,41 +2,44 @@ import { useEffect as e } from "react";
 import { useSearchParams as t } from "react-router-dom";
 import { jsx as n } from "react/jsx-runtime";
 //#region src/auth/pages/SSORelayPage.tsx
-var r = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai".split(",")), i = "relayChain", a = "sso_failed";
-function o(e) {
+var r = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai".split(",")), i = "relayChain", a = "sso_failed", o = new Set(["localhost", "127.0.0.1"]), s = {
+	"bf-sso": /(?:^|;\s*)bf-sso=([^;]*)/,
+	"bf-sso-profile": /(?:^|;\s*)bf-sso-profile=([^;]*)/
+};
+function c(e) {
 	if (e.hostname === "localhost" || e.hostname === "127.0.0.1" || e.hostname.endsWith(".local.burdenoff.com")) return !0;
 	if (e.protocol !== "https:") return !1;
 	for (let t of r) if (e.hostname === t || e.hostname === `app.${t}` || e.hostname === `alphaapp.${t}` || e.hostname === `www.${t}`) return !0;
 	return !1;
 }
-function s() {
+function l() {
 	try {
 		let e = window.location.hostname, t = e.endsWith(".local.burdenoff.com") ? ".local.burdenoff.com" : void 0;
-		for (let n of ["bf-sso", "bf-sso-profile"]) document.cookie = `${n}=; path=/; max-age=0`, t && (document.cookie = `${n}=; path=/; domain=${t}; max-age=0`), e && !["localhost", "127.0.0.1"].includes(e) && (document.cookie = `${n}=; path=/; domain=${e}; max-age=0`);
+		for (let n of ["bf-sso", "bf-sso-profile"]) document.cookie = `${n}=; path=/; max-age=0`, t && (document.cookie = `${n}=; path=/; domain=${t}; max-age=0`), e && !o.has(e) && (document.cookie = `${n}=; path=/; domain=${e}; max-age=0`);
 	} catch {}
 }
-function c() {
+function u() {
 	try {
 		return (new URLSearchParams(window.location.search).get(i) || "").split("|").filter((e) => e.length > 0);
 	} catch {
 		return [];
 	}
 }
-function l(e) {
+function d(e) {
 	try {
 		let t = new URL(e, window.location.origin);
-		return t.origin !== window.location.origin && !o(t) ? "/auth/login" : (t.searchParams.set(a, "1"), t.href);
+		return t.origin !== window.location.origin && !c(t) ? "/auth/login" : (t.searchParams.set(a, "1"), t.href);
 	} catch {
 		return "/auth/login?sso_failed=1";
 	}
 }
-function u() {
-	return d()?.id ?? null;
+function f() {
+	return p()?.id ?? null;
 }
-function d() {
+function p() {
 	try {
 		for (let e of ["bf-sso", "bf-sso-profile"]) {
-			let t = document.cookie.match(RegExp(`(?:^|;\\s*)${e}=([^;]*)`));
+			let t = document.cookie.match(s[e]);
 			if (!t) continue;
 			let n = JSON.parse(decodeURIComponent(t[1]));
 			if (typeof n == "string") return {
@@ -53,13 +56,13 @@ function d() {
 	}
 	return null;
 }
-function f(e) {
+function m(e) {
 	try {
-		let t = d();
+		let t = p();
 		if (!t?.origin) return !1;
 		let n = new URL(t.origin);
-		if (!o(n) || n.origin === window.location.origin) return !1;
-		let r = c();
+		if (!c(n) || n.origin === window.location.origin) return !1;
+		let r = u();
 		if (r.includes(n.origin) || r.length >= 3) return !1;
 		let a = new URL("/auth/sso-relay", n.origin);
 		return a.searchParams.set("returnTo", e), a.searchParams.set(i, Array.from(new Set([...r, window.location.origin])).join("|")), window.location.replace(a.href), !0;
@@ -67,19 +70,22 @@ function f(e) {
 		return !1;
 	}
 }
-function p() {
+function h() {
+	return localStorage.getItem("bf-profiles");
+}
+function g() {
 	try {
-		let e = localStorage.getItem("bf-profiles");
+		let e = h();
 		return (e ? JSON.parse(e) : []).map((e) => e.id).filter((e) => typeof e == "string" && e.length > 0);
 	} catch {
 		return [];
 	}
 }
-function m() {
+function _() {
 	let e = [
-		u(),
+		f(),
 		sessionStorage.getItem("bf-active-profile"),
-		...p()
+		...g()
 	].filter((e) => typeof e == "string" && e.length > 0);
 	for (let t of Array.from(new Set(e))) {
 		let e = localStorage.getItem(`bf-p-${t}-tokens`), n = localStorage.getItem(`bf-p-${t}-user`);
@@ -87,48 +93,48 @@ function m() {
 	}
 	return null;
 }
-function h() {
+function v() {
 	let [r] = t();
 	return e(() => {
 		let e = r.get("returnTo");
 		if (!e) return;
-		let t = m();
+		let t = _();
 		if (!t) {
-			if (f(e)) return;
-			s(), window.location.replace(l(e));
+			if (m(e)) return;
+			l(), window.location.replace(d(e));
 			return;
 		}
-		let n = localStorage.getItem(`bf-p-${t}-tokens`), i = localStorage.getItem(`bf-p-${t}-user`), a = localStorage.getItem("bf-profiles");
+		let n = localStorage.getItem(`bf-p-${t}-tokens`), i = localStorage.getItem(`bf-p-${t}-user`), a = h();
 		if (!n || !i) {
-			if (f(e)) return;
-			s(), window.location.replace(l(e));
+			if (m(e)) return;
+			l(), window.location.replace(d(e));
 			return;
 		}
-		let c = btoa(JSON.stringify({
+		let o = btoa(JSON.stringify({
 			profileId: t,
 			tokens: n,
 			user: i,
 			profiles: a
-		})), u;
+		})), s;
 		try {
 			let t = new URL(e);
-			if (!o(t)) {
+			if (!c(t)) {
 				window.location.replace("/");
 				return;
 			}
 			let n = t.pathname + t.search;
-			u = `${t.origin}/auth/sso-callback?returnTo=${encodeURIComponent(n)}#sso=${c}`;
+			s = `${t.origin}/auth/sso-callback?returnTo=${encodeURIComponent(n)}#sso=${o}`;
 		} catch {
 			window.location.replace(e);
 			return;
 		}
-		window.location.replace(u);
+		window.location.replace(s);
 	}, [r]), /* @__PURE__ */ n("div", {
 		className: "flex items-center justify-center min-h-screen bg-bg-canvas",
-		children: /* @__PURE__ */ n("div", { className: "animate-spin rounded-full h-8 w-8 border-2 border-action-primary-bg border-t-transparent" })
+		children: /* @__PURE__ */ n("div", { className: "animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent" })
 	});
 }
 //#endregion
-export { h as SSORelayPage };
+export { v as SSORelayPage };
 
 //# sourceMappingURL=SSORelayPage.js.map

package/dist/auth/pages/SSORelayPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SSORelayPage.js","names":[],"sources":["../../../src/auth/pages/SSORelayPage.tsx"],"sourcesContent":["/**\n * SSORelayPage — Cross-domain SSO token relay.\n *\n * This page is loaded on the ORIGIN where the user is logged in.\n * It reads tokens from localStorage and redirects to the TARGET domain's\n * /auth/sso-callback with the tokens in a URL fragment (not query param\n * for security — fragments are not sent to servers).\n *\n * Flow:\n * 1. User visits productA.com → not logged in → detects SSO cookie\n * 2. Redirect to productB.com/auth/sso-relay?returnTo=productA.com/dashboard\n *    (productB is where the user IS logged in — identified by cookie)\n * 3. This page reads tokens from productB's localStorage\n * 4. Redirects to productA.com/auth/sso-callback#token=<base64-encoded-tokens>\n * 5. SSORelayCallbackPage on productA decodes and stores tokens, redirects to /dashboard\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\n\nconst ALLOWED_RELAY_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n]);\n\nconst RELAY_CHAIN_PARAM = \"relayChain\";\nconst RELAY_FAILED_PARAM = \"sso_failed\";\n\nfunction isAllowedRelayTarget(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") {\n    return true;\n  }\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) {\n    return true;\n  }\n  if (url.protocol !== \"https:\") {\n    return false;\n  }\n  for (const domain of ALLOWED_RELAY_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction clearRelayCookies(): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    for (const cookieName of [\"bf-sso\", \"bf-sso-profile\"] as const) {\n      document.cookie = `${cookieName}=; path=/; max-age=0`;\n      if (domain) {\n        document.cookie = `${cookieName}=; path=/; domain=${domain}; max-age=0`;\n      }\n      if (hostname && ![\"localhost\", \"127.0.0.1\"].includes(hostname)) {\n        document.cookie = `${cookieName}=; path=/; domain=${hostname}; max-age=0`;\n      }\n    }\n  } catch {\n    /* best effort */\n  }\n}\n\nfunction getRelayChain(): string[] {\n  try {\n    return (\n      new URLSearchParams(window.location.search).get(RELAY_CHAIN_PARAM) || \"\"\n    )\n      .split(\"|\")\n      .filter((origin) => origin.length > 0);\n  } catch {\n    return [];\n  }\n}\n\nfunction getFailedReturnTo(returnTo: string): string {\n  try {\n    const targetUrl = new URL(returnTo, window.location.origin);\n    if (\n      targetUrl.origin !== window.location.origin &&\n      !isAllowedRelayTarget(targetUrl)\n    ) {\n      return \"/auth/login\";\n    }\n    targetUrl.searchParams.set(RELAY_FAILED_PARAM, \"1\");\n    return targetUrl.href;\n  } catch {\n    return \"/auth/login?sso_failed=1\";\n  }\n}\n\nfunction readSsoCookieProfileId(): string | null {\n  return readSsoCookieData()?.id ?? null;\n}\n\nfunction readSsoCookieData(): {\n  id: string | null;\n  origin: string | null;\n} | null {\n  try {\n    for (const cookieName of [\"bf-sso\", \"bf-sso-profile\"] as const) {\n      const match = document.cookie.match(\n        new RegExp(`(?:^|;\\\\s*)${cookieName}=([^;]*)`),\n      );\n      if (!match) continue;\n\n      const parsed = JSON.parse(decodeURIComponent(match[1])) as\n        | string\n        | { id?: unknown; origin?: unknown };\n      if (typeof parsed === \"string\") return { id: parsed, origin: null };\n      if (typeof parsed.id === \"string\" && parsed.id.length > 0) {\n        return {\n          id: parsed.id,\n          origin: typeof parsed.origin === \"string\" ? parsed.origin : null,\n        };\n      }\n    }\n  } catch {\n    return null;\n  }\n  return null;\n}\n\nfunction redirectToCookieRelayOrigin(returnTo: string): boolean {\n  try {\n    const ssoCookie = readSsoCookieData();\n    if (!ssoCookie?.origin) return false;\n\n    const relayUrl = new URL(ssoCookie.origin);\n    if (!isAllowedRelayTarget(relayUrl)) return false;\n    if (relayUrl.origin === window.location.origin) return false;\n\n    const relayChain = getRelayChain();\n    if (relayChain.includes(relayUrl.origin) || relayChain.length >= 3) {\n      return false;\n    }\n\n    const nextRelayUrl = new URL(\"/auth/sso-relay\", relayUrl.origin);\n    nextRelayUrl.searchParams.set(\"returnTo\", returnTo);\n    nextRelayUrl.searchParams.set(\n      RELAY_CHAIN_PARAM,\n      Array.from(new Set([...relayChain, window.location.origin])).join(\"|\"),\n    );\n\n    window.location.replace(nextRelayUrl.href);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction readProfileIds(): string[] {\n  try {\n    const profilesRaw = localStorage.getItem(\"bf-profiles\");\n    const profiles = profilesRaw\n      ? (JSON.parse(profilesRaw) as Array<{ id?: unknown }>)\n      : [];\n    return profiles\n      .map((profile) => profile.id)\n      .filter((id): id is string => typeof id === \"string\" && id.length > 0);\n  } catch {\n    return [];\n  }\n}\n\nfunction resolveRelayProfileId(): string | null {\n  const candidates = [\n    readSsoCookieProfileId(),\n    sessionStorage.getItem(\"bf-active-profile\"),\n    ...readProfileIds(),\n  ].filter((id): id is string => typeof id === \"string\" && id.length > 0);\n\n  for (const profileId of Array.from(new Set(candidates))) {\n    const tokensRaw = localStorage.getItem(`bf-p-${profileId}-tokens`);\n    const userRaw = localStorage.getItem(`bf-p-${profileId}-user`);\n    if (tokensRaw && userRaw) {\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      return profileId;\n    }\n  }\n\n  return null;\n}\n\nexport function SSORelayPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = searchParams.get(\"returnTo\");\n    if (!returnTo) {\n      // No return URL — just show a blank page\n      return;\n    }\n\n    // Read tokens from localStorage (this origin has them). Prefer the shared\n    // SSO cookie profile because a relay often runs in a new tab with empty\n    // sessionStorage and stale historical profiles in localStorage.\n    const profileId = resolveRelayProfileId();\n    if (!profileId) {\n      if (redirectToCookieRelayOrigin(returnTo)) return;\n      clearRelayCookies();\n      window.location.replace(getFailedReturnTo(returnTo));\n      return;\n    }\n\n    const tokensRaw = localStorage.getItem(`bf-p-${profileId}-tokens`);\n    const userRaw = localStorage.getItem(`bf-p-${profileId}-user`);\n    const profilesRaw = localStorage.getItem(\"bf-profiles\");\n\n    if (!tokensRaw || !userRaw) {\n      // No tokens — redirect back without them\n      if (redirectToCookieRelayOrigin(returnTo)) return;\n      clearRelayCookies();\n      window.location.replace(getFailedReturnTo(returnTo));\n      return;\n    }\n\n    // Encode the auth state as a base64 URL fragment\n    const payload = {\n      profileId,\n      tokens: tokensRaw,\n      user: userRaw,\n      profiles: profilesRaw,\n    };\n    const encoded = btoa(JSON.stringify(payload));\n\n    // Build the callback URL on the target domain\n    // Parse returnTo to get the target origin\n    let callbackUrl: string;\n    try {\n      const targetUrl = new URL(returnTo);\n      if (!isAllowedRelayTarget(targetUrl)) {\n        window.location.replace(\"/\");\n        return;\n      }\n      const returnPath = targetUrl.pathname + targetUrl.search;\n      callbackUrl = `${targetUrl.origin}/auth/sso-callback?returnTo=${encodeURIComponent(returnPath)}#sso=${encoded}`;\n    } catch {\n      // returnTo is a relative path — can't do cross-domain relay\n      window.location.replace(returnTo);\n      return;\n    }\n\n    // Redirect to the callback\n    window.location.replace(callbackUrl);\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full h-8 w-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;AAoBA,IAAM,IAAwB,IAAI,IAAI,qkBAkCrC,CAAC,EAEI,IAAoB,cACpB,IAAqB;AAE3B,SAAS,EAAqB,GAAmB;AAI/C,KAHI,EAAI,aAAa,eAAe,EAAI,aAAa,eAGjD,EAAI,SAAS,SAAS,uBAAuB,CAC/C,QAAO;AAET,KAAI,EAAI,aAAa,SACnB,QAAO;AAET,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAC7B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,IAA0B;AACjC,KAAI;EACF,IAAM,IAAW,OAAO,SAAS,UAC3B,IAAS,EAAS,SAAS,uBAAuB,GACpD,yBACA,KAAA;AACJ,OAAK,IAAM,KAAc,CAAC,UAAU,iBAAiB,CAKnD,CAJA,SAAS,SAAS,GAAG,EAAW,uBAC5B,MACF,SAAS,SAAS,GAAG,EAAW,oBAAoB,EAAO,eAEzD,KAAY,CAAC,CAAC,aAAa,YAAY,CAAC,SAAS,EAAS,KAC5D,SAAS,SAAS,GAAG,EAAW,oBAAoB,EAAS;SAG3D;;AAKV,SAAS,IAA0B;AACjC,KAAI;AACF,UACE,IAAI,gBAAgB,OAAO,SAAS,OAAO,CAAC,IAAI,EAAkB,IAAI,IAErE,MAAM,IAAI,CACV,QAAQ,MAAW,EAAO,SAAS,EAAE;SAClC;AACN,SAAO,EAAE;;;AAIb,SAAS,EAAkB,GAA0B;AACnD,KAAI;EACF,IAAM,IAAY,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AAQ3D,SANE,EAAU,WAAW,OAAO,SAAS,UACrC,CAAC,EAAqB,EAAU,GAEzB,iBAET,EAAU,aAAa,IAAI,GAAoB,IAAI,EAC5C,EAAU;SACX;AACN,SAAO;;;AAIX,SAAS,IAAwC;AAC/C,QAAO,GAAmB,EAAE,MAAM;;AAGpC,SAAS,IAGA;AACP,KAAI;AACF,OAAK,IAAM,KAAc,CAAC,UAAU,iBAAiB,EAAW;GAC9D,IAAM,IAAQ,SAAS,OAAO,MACxB,OAAO,cAAc,EAAW,UAAU,CAC/C;AACD,OAAI,CAAC,EAAO;GAEZ,IAAM,IAAS,KAAK,MAAM,mBAAmB,EAAM,GAAG,CAAC;AAGvD,OAAI,OAAO,KAAW,SAAU,QAAO;IAAE,IAAI;IAAQ,QAAQ;IAAM;AACnE,OAAI,OAAO,EAAO,MAAO,YAAY,EAAO,GAAG,SAAS,EACtD,QAAO;IACL,IAAI,EAAO;IACX,QAAQ,OAAO,EAAO,UAAW,WAAW,EAAO,SAAS;IAC7D;;SAGC;AACN,SAAO;;AAET,QAAO;;AAGT,SAAS,EAA4B,GAA2B;AAC9D,KAAI;EACF,IAAM,IAAY,GAAmB;AACrC,MAAI,CAAC,GAAW,OAAQ,QAAO;EAE/B,IAAM,IAAW,IAAI,IAAI,EAAU,OAAO;AAE1C,MADI,CAAC,EAAqB,EAAS,IAC/B,EAAS,WAAW,OAAO,SAAS,OAAQ,QAAO;EAEvD,IAAM,IAAa,GAAe;AAClC,MAAI,EAAW,SAAS,EAAS,OAAO,IAAI,EAAW,UAAU,EAC/D,QAAO;EAGT,IAAM,IAAe,IAAI,IAAI,mBAAmB,EAAS,OAAO;AAQhE,SAPA,EAAa,aAAa,IAAI,YAAY,EAAS,EACnD,EAAa,aAAa,IACxB,GACA,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,GAAY,OAAO,SAAS,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CACvE,EAED,OAAO,SAAS,QAAQ,EAAa,KAAK,EACnC;SACD;AACN,SAAO;;;AAIX,SAAS,IAA2B;AAClC,KAAI;EACF,IAAM,IAAc,aAAa,QAAQ,cAAc;AAIvD,UAHiB,IACZ,KAAK,MAAM,EAAY,GACxB,EAAE,EAEH,KAAK,MAAY,EAAQ,GAAG,CAC5B,QAAQ,MAAqB,OAAO,KAAO,YAAY,EAAG,SAAS,EAAE;SAClE;AACN,SAAO,EAAE;;;AAIb,SAAS,IAAuC;CAC9C,IAAM,IAAa;EACjB,GAAwB;EACxB,eAAe,QAAQ,oBAAoB;EAC3C,GAAG,GAAgB;EACpB,CAAC,QAAQ,MAAqB,OAAO,KAAO,YAAY,EAAG,SAAS,EAAE;AAEvE,MAAK,IAAM,KAAa,MAAM,KAAK,IAAI,IAAI,EAAW,CAAC,EAAE;EACvD,IAAM,IAAY,aAAa,QAAQ,QAAQ,EAAU,SAAS,EAC5D,IAAU,aAAa,QAAQ,QAAQ,EAAU,OAAO;AAC9D,MAAI,KAAa,EAEf,QADA,eAAe,QAAQ,qBAAqB,EAAU,EAC/C;;AAIX,QAAO;;AAGT,SAAgB,IAAe;CAC7B,IAAM,CAAC,KAAgB,GAAiB;AA8DxC,QA5DA,QAAgB;EACd,IAAM,IAAW,EAAa,IAAI,WAAW;AAC7C,MAAI,CAAC,EAEH;EAMF,IAAM,IAAY,GAAuB;AACzC,MAAI,CAAC,GAAW;AACd,OAAI,EAA4B,EAAS,CAAE;AAE3C,GADA,GAAmB,EACnB,OAAO,SAAS,QAAQ,EAAkB,EAAS,CAAC;AACpD;;EAGF,IAAM,IAAY,aAAa,QAAQ,QAAQ,EAAU,SAAS,EAC5D,IAAU,aAAa,QAAQ,QAAQ,EAAU,OAAO,EACxD,IAAc,aAAa,QAAQ,cAAc;AAEvD,MAAI,CAAC,KAAa,CAAC,GAAS;AAE1B,OAAI,EAA4B,EAAS,CAAE;AAE3C,GADA,GAAmB,EACnB,OAAO,SAAS,QAAQ,EAAkB,EAAS,CAAC;AACpD;;EAUF,IAAM,IAAU,KAAK,KAAK,UANV;GACd;GACA,QAAQ;GACR,MAAM;GACN,UAAU;GACX,CAC2C,CAAC,EAIzC;AACJ,MAAI;GACF,IAAM,IAAY,IAAI,IAAI,EAAS;AACnC,OAAI,CAAC,EAAqB,EAAU,EAAE;AACpC,WAAO,SAAS,QAAQ,IAAI;AAC5B;;GAEF,IAAM,IAAa,EAAU,WAAW,EAAU;AAClD,OAAc,GAAG,EAAU,OAAO,8BAA8B,mBAAmB,EAAW,CAAC,OAAO;UAChG;AAEN,UAAO,SAAS,QAAQ,EAAS;AACjC;;AAIF,SAAO,SAAS,QAAQ,EAAY;IACnC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,4FAA6F,CAAA;EACxG,CAAA"}
+{"version":3,"file":"SSORelayPage.js","names":[],"sources":["../../../src/auth/pages/SSORelayPage.tsx"],"sourcesContent":["/**\n * SSORelayPage — Cross-domain SSO token relay.\n *\n * This page is loaded on the ORIGIN where the user is logged in.\n * It reads tokens from localStorage and redirects to the TARGET domain's\n * /auth/sso-callback with the tokens in a URL fragment (not query param\n * for security — fragments are not sent to servers).\n *\n * Flow:\n * 1. User visits productA.com → not logged in → detects SSO cookie\n * 2. Redirect to productB.com/auth/sso-relay?returnTo=productA.com/dashboard\n *    (productB is where the user IS logged in — identified by cookie)\n * 3. This page reads tokens from productB's localStorage\n * 4. Redirects to productA.com/auth/sso-callback#token=<base64-encoded-tokens>\n * 5. SSORelayCallbackPage on productA decodes and stores tokens, redirects to /dashboard\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\n\nconst ALLOWED_RELAY_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n]);\n\nconst RELAY_CHAIN_PARAM = \"relayChain\";\nconst RELAY_FAILED_PARAM = \"sso_failed\";\nconst LOCAL_HOSTNAMES = new Set([\"localhost\", \"127.0.0.1\"]);\n\nconst SSO_COOKIE_PATTERNS = {\n  \"bf-sso\": /(?:^|;\\s*)bf-sso=([^;]*)/,\n  \"bf-sso-profile\": /(?:^|;\\s*)bf-sso-profile=([^;]*)/,\n} as const;\n\nfunction isAllowedRelayTarget(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") {\n    return true;\n  }\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) {\n    return true;\n  }\n  if (url.protocol !== \"https:\") {\n    return false;\n  }\n  for (const domain of ALLOWED_RELAY_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction clearRelayCookies(): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    for (const cookieName of [\"bf-sso\", \"bf-sso-profile\"] as const) {\n      document.cookie = `${cookieName}=; path=/; max-age=0`;\n      if (domain) {\n        document.cookie = `${cookieName}=; path=/; domain=${domain}; max-age=0`;\n      }\n      if (hostname && !LOCAL_HOSTNAMES.has(hostname)) {\n        document.cookie = `${cookieName}=; path=/; domain=${hostname}; max-age=0`;\n      }\n    }\n  } catch {\n    /* best effort */\n  }\n}\n\nfunction getRelayChain(): string[] {\n  try {\n    return (\n      new URLSearchParams(window.location.search).get(RELAY_CHAIN_PARAM) || \"\"\n    )\n      .split(\"|\")\n      .filter((origin) => origin.length > 0);\n  } catch {\n    return [];\n  }\n}\n\nfunction getFailedReturnTo(returnTo: string): string {\n  try {\n    const targetUrl = new URL(returnTo, window.location.origin);\n    if (\n      targetUrl.origin !== window.location.origin &&\n      !isAllowedRelayTarget(targetUrl)\n    ) {\n      return \"/auth/login\";\n    }\n    targetUrl.searchParams.set(RELAY_FAILED_PARAM, \"1\");\n    return targetUrl.href;\n  } catch {\n    return \"/auth/login?sso_failed=1\";\n  }\n}\n\nfunction readSsoCookieProfileId(): string | null {\n  return readSsoCookieData()?.id ?? null;\n}\n\nfunction readSsoCookieData(): {\n  id: string | null;\n  origin: string | null;\n} | null {\n  try {\n    for (const cookieName of [\"bf-sso\", \"bf-sso-profile\"] as const) {\n      const match = document.cookie.match(SSO_COOKIE_PATTERNS[cookieName]);\n      if (!match) continue;\n\n      const parsed = JSON.parse(decodeURIComponent(match[1])) as\n        | string\n        | { id?: unknown; origin?: unknown };\n      if (typeof parsed === \"string\") return { id: parsed, origin: null };\n      if (typeof parsed.id === \"string\" && parsed.id.length > 0) {\n        return {\n          id: parsed.id,\n          origin: typeof parsed.origin === \"string\" ? parsed.origin : null,\n        };\n      }\n    }\n  } catch {\n    return null;\n  }\n  return null;\n}\n\nfunction redirectToCookieRelayOrigin(returnTo: string): boolean {\n  try {\n    const ssoCookie = readSsoCookieData();\n    if (!ssoCookie?.origin) return false;\n\n    const relayUrl = new URL(ssoCookie.origin);\n    if (!isAllowedRelayTarget(relayUrl)) return false;\n    if (relayUrl.origin === window.location.origin) return false;\n\n    const relayChain = getRelayChain();\n    if (relayChain.includes(relayUrl.origin) || relayChain.length >= 3) {\n      return false;\n    }\n\n    const nextRelayUrl = new URL(\"/auth/sso-relay\", relayUrl.origin);\n    nextRelayUrl.searchParams.set(\"returnTo\", returnTo);\n    nextRelayUrl.searchParams.set(\n      RELAY_CHAIN_PARAM,\n      Array.from(new Set([...relayChain, window.location.origin])).join(\"|\"),\n    );\n\n    window.location.replace(nextRelayUrl.href);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction readProfilesRaw(): string | null {\n  return localStorage.getItem(\"bf-profiles\");\n}\n\nfunction readProfileIds(): string[] {\n  try {\n    const profilesRaw = readProfilesRaw();\n    const profiles = profilesRaw\n      ? (JSON.parse(profilesRaw) as Array<{ id?: unknown }>)\n      : [];\n    return profiles\n      .map((profile) => profile.id)\n      .filter((id): id is string => typeof id === \"string\" && id.length > 0);\n  } catch {\n    return [];\n  }\n}\n\nfunction resolveRelayProfileId(): string | null {\n  const candidates = [\n    readSsoCookieProfileId(),\n    sessionStorage.getItem(\"bf-active-profile\"),\n    ...readProfileIds(),\n  ].filter((id): id is string => typeof id === \"string\" && id.length > 0);\n\n  for (const profileId of Array.from(new Set(candidates))) {\n    const tokensRaw = localStorage.getItem(`bf-p-${profileId}-tokens`);\n    const userRaw = localStorage.getItem(`bf-p-${profileId}-user`);\n    if (tokensRaw && userRaw) {\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      return profileId;\n    }\n  }\n\n  return null;\n}\n\nexport function SSORelayPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = searchParams.get(\"returnTo\");\n    if (!returnTo) {\n      // No return URL — just show a blank page\n      return;\n    }\n\n    // Read tokens from localStorage (this origin has them). Prefer the shared\n    // SSO cookie profile because a relay often runs in a new tab with empty\n    // sessionStorage and stale historical profiles in localStorage.\n    const profileId = resolveRelayProfileId();\n    if (!profileId) {\n      if (redirectToCookieRelayOrigin(returnTo)) return;\n      clearRelayCookies();\n      window.location.replace(getFailedReturnTo(returnTo));\n      return;\n    }\n\n    const tokensRaw = localStorage.getItem(`bf-p-${profileId}-tokens`);\n    const userRaw = localStorage.getItem(`bf-p-${profileId}-user`);\n    const profilesRaw = readProfilesRaw();\n\n    if (!tokensRaw || !userRaw) {\n      // No tokens — redirect back without them\n      if (redirectToCookieRelayOrigin(returnTo)) return;\n      clearRelayCookies();\n      window.location.replace(getFailedReturnTo(returnTo));\n      return;\n    }\n\n    // Encode the auth state as a base64 URL fragment\n    const payload = {\n      profileId,\n      tokens: tokensRaw,\n      user: userRaw,\n      profiles: profilesRaw,\n    };\n    const encoded = btoa(JSON.stringify(payload));\n\n    // Build the callback URL on the target domain\n    // Parse returnTo to get the target origin\n    let callbackUrl: string;\n    try {\n      const targetUrl = new URL(returnTo);\n      if (!isAllowedRelayTarget(targetUrl)) {\n        window.location.replace(\"/\");\n        return;\n      }\n      const returnPath = targetUrl.pathname + targetUrl.search;\n      callbackUrl = `${targetUrl.origin}/auth/sso-callback?returnTo=${encodeURIComponent(returnPath)}#sso=${encoded}`;\n    } catch {\n      // returnTo is a relative path — can't do cross-domain relay\n      window.location.replace(returnTo);\n      return;\n    }\n\n    // Redirect to the callback\n    window.location.replace(callbackUrl);\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;AAoBA,IAAM,IAAwB,IAAI,IAAI,qkBAkCrC,CAAC,EAEI,IAAoB,cACpB,IAAqB,cACrB,IAAkB,IAAI,IAAI,CAAC,aAAa,YAAY,CAAC,EAErD,IAAsB;CAC1B,UAAU;CACV,kBAAkB;CACnB;AAED,SAAS,EAAqB,GAAmB;AAI/C,KAHI,EAAI,aAAa,eAAe,EAAI,aAAa,eAGjD,EAAI,SAAS,SAAS,uBAAuB,CAC/C,QAAO;AAET,KAAI,EAAI,aAAa,SACnB,QAAO;AAET,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAC7B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,IAA0B;AACjC,KAAI;EACF,IAAM,IAAW,OAAO,SAAS,UAC3B,IAAS,EAAS,SAAS,uBAAuB,GACpD,yBACA,KAAA;AACJ,OAAK,IAAM,KAAc,CAAC,UAAU,iBAAiB,CAKnD,CAJA,SAAS,SAAS,GAAG,EAAW,uBAC5B,MACF,SAAS,SAAS,GAAG,EAAW,oBAAoB,EAAO,eAEzD,KAAY,CAAC,EAAgB,IAAI,EAAS,KAC5C,SAAS,SAAS,GAAG,EAAW,oBAAoB,EAAS;SAG3D;;AAKV,SAAS,IAA0B;AACjC,KAAI;AACF,UACE,IAAI,gBAAgB,OAAO,SAAS,OAAO,CAAC,IAAI,EAAkB,IAAI,IAErE,MAAM,IAAI,CACV,QAAQ,MAAW,EAAO,SAAS,EAAE;SAClC;AACN,SAAO,EAAE;;;AAIb,SAAS,EAAkB,GAA0B;AACnD,KAAI;EACF,IAAM,IAAY,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AAQ3D,SANE,EAAU,WAAW,OAAO,SAAS,UACrC,CAAC,EAAqB,EAAU,GAEzB,iBAET,EAAU,aAAa,IAAI,GAAoB,IAAI,EAC5C,EAAU;SACX;AACN,SAAO;;;AAIX,SAAS,IAAwC;AAC/C,QAAO,GAAmB,EAAE,MAAM;;AAGpC,SAAS,IAGA;AACP,KAAI;AACF,OAAK,IAAM,KAAc,CAAC,UAAU,iBAAiB,EAAW;GAC9D,IAAM,IAAQ,SAAS,OAAO,MAAM,EAAoB,GAAY;AACpE,OAAI,CAAC,EAAO;GAEZ,IAAM,IAAS,KAAK,MAAM,mBAAmB,EAAM,GAAG,CAAC;AAGvD,OAAI,OAAO,KAAW,SAAU,QAAO;IAAE,IAAI;IAAQ,QAAQ;IAAM;AACnE,OAAI,OAAO,EAAO,MAAO,YAAY,EAAO,GAAG,SAAS,EACtD,QAAO;IACL,IAAI,EAAO;IACX,QAAQ,OAAO,EAAO,UAAW,WAAW,EAAO,SAAS;IAC7D;;SAGC;AACN,SAAO;;AAET,QAAO;;AAGT,SAAS,EAA4B,GAA2B;AAC9D,KAAI;EACF,IAAM,IAAY,GAAmB;AACrC,MAAI,CAAC,GAAW,OAAQ,QAAO;EAE/B,IAAM,IAAW,IAAI,IAAI,EAAU,OAAO;AAE1C,MADI,CAAC,EAAqB,EAAS,IAC/B,EAAS,WAAW,OAAO,SAAS,OAAQ,QAAO;EAEvD,IAAM,IAAa,GAAe;AAClC,MAAI,EAAW,SAAS,EAAS,OAAO,IAAI,EAAW,UAAU,EAC/D,QAAO;EAGT,IAAM,IAAe,IAAI,IAAI,mBAAmB,EAAS,OAAO;AAQhE,SAPA,EAAa,aAAa,IAAI,YAAY,EAAS,EACnD,EAAa,aAAa,IACxB,GACA,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,GAAY,OAAO,SAAS,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CACvE,EAED,OAAO,SAAS,QAAQ,EAAa,KAAK,EACnC;SACD;AACN,SAAO;;;AAIX,SAAS,IAAiC;AACxC,QAAO,aAAa,QAAQ,cAAc;;AAG5C,SAAS,IAA2B;AAClC,KAAI;EACF,IAAM,IAAc,GAAiB;AAIrC,UAHiB,IACZ,KAAK,MAAM,EAAY,GACxB,EAAE,EAEH,KAAK,MAAY,EAAQ,GAAG,CAC5B,QAAQ,MAAqB,OAAO,KAAO,YAAY,EAAG,SAAS,EAAE;SAClE;AACN,SAAO,EAAE;;;AAIb,SAAS,IAAuC;CAC9C,IAAM,IAAa;EACjB,GAAwB;EACxB,eAAe,QAAQ,oBAAoB;EAC3C,GAAG,GAAgB;EACpB,CAAC,QAAQ,MAAqB,OAAO,KAAO,YAAY,EAAG,SAAS,EAAE;AAEvE,MAAK,IAAM,KAAa,MAAM,KAAK,IAAI,IAAI,EAAW,CAAC,EAAE;EACvD,IAAM,IAAY,aAAa,QAAQ,QAAQ,EAAU,SAAS,EAC5D,IAAU,aAAa,QAAQ,QAAQ,EAAU,OAAO;AAC9D,MAAI,KAAa,EAEf,QADA,eAAe,QAAQ,qBAAqB,EAAU,EAC/C;;AAIX,QAAO;;AAGT,SAAgB,IAAe;CAC7B,IAAM,CAAC,KAAgB,GAAiB;AA8DxC,QA5DA,QAAgB;EACd,IAAM,IAAW,EAAa,IAAI,WAAW;AAC7C,MAAI,CAAC,EAEH;EAMF,IAAM,IAAY,GAAuB;AACzC,MAAI,CAAC,GAAW;AACd,OAAI,EAA4B,EAAS,CAAE;AAE3C,GADA,GAAmB,EACnB,OAAO,SAAS,QAAQ,EAAkB,EAAS,CAAC;AACpD;;EAGF,IAAM,IAAY,aAAa,QAAQ,QAAQ,EAAU,SAAS,EAC5D,IAAU,aAAa,QAAQ,QAAQ,EAAU,OAAO,EACxD,IAAc,GAAiB;AAErC,MAAI,CAAC,KAAa,CAAC,GAAS;AAE1B,OAAI,EAA4B,EAAS,CAAE;AAE3C,GADA,GAAmB,EACnB,OAAO,SAAS,QAAQ,EAAkB,EAAS,CAAC;AACpD;;EAUF,IAAM,IAAU,KAAK,KAAK,UANV;GACd;GACA,QAAQ;GACR,MAAM;GACN,UAAU;GACX,CAC2C,CAAC,EAIzC;AACJ,MAAI;GACF,IAAM,IAAY,IAAI,IAAI,EAAS;AACnC,OAAI,CAAC,EAAqB,EAAU,EAAE;AACpC,WAAO,SAAS,QAAQ,IAAI;AAC5B;;GAEF,IAAM,IAAa,EAAU,WAAW,EAAU;AAClD,OAAc,GAAG,EAAU,OAAO,8BAA8B,mBAAmB,EAAW,CAAC,OAAO;UAChG;AAEN,UAAO,SAAS,QAAQ,EAAS;AACjC;;AAIF,SAAO,SAAS,QAAQ,EAAY;IACnC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,2FAA4F,CAAA;EACvG,CAAA"}